SPN Scanning & Service Discovery
Service Principal Names let attackers discover every service running in your domain -- including SQL servers, web apps, and Exchange -- without sending a single network scan packet.
Every service that uses Kerberos authentication in Active Directory registers a Service Principal Name (SPN). Think of it as a label that says "I am a SQL server running on server01." When attackers query the directory for all SPNs, they get a complete inventory of every service in the domain -- without running any network scans that might trigger alerts. This is stealthier than port scanning because it is just a normal directory query. The attacker then knows exactly which services to target and, critically, which accounts run those services (important for Kerberoasting).
Instead of walking around every floor to find who does what, you simply look up the company phone directory. It lists every employee along with their job title and department. SPN scanning works the same way: rather than performing noisy port scans across the network, attackers query Active Directory's service directory to discover every registered service -- SQL databases, web servers, mail servers, and more. The directory tells them not only what services exist, but exactly which server hosts them and which account runs them.
Key Takeaways
- SPN scanning discovers all Kerberos-authenticated services without network port scanning.
- Services running under user accounts with SPNs are vulnerable to Kerberoasting.
- The LDAP query is normal directory traffic, making detection difficult.
- Group Managed Service Accounts (gMSAs) eliminate the risk by using auto-rotated complex passwords.
- SPN scanning is the direct precursor to Kerberoasting attacks.
SPN scanning reveals the attack surface for Kerberoasting, one of the most common and effective AD attacks. Knowing your SPN landscape is essential for defense.
Defense Recommendations
Reduce the SPN attack surface and make cracking impractical with managed service accounts.
- 1Migrate service accounts to Group Managed Service Accounts (gMSAs) wherever possible.
- 2Audit all user accounts with SPNs: Get-ADUser -Filter {servicePrincipalName -like "*"} -Properties servicePrincipalName.
- 3Remove unnecessary SPNs from user accounts.
- 4Ensure service account passwords are 25+ characters and randomly generated.
- 5Monitor for high-volume SPN queries from non-administrative workstations.