From Heuristics to Histograms: Reinventing Kerberoasting Detections

Every Active Directory environment has blind spots, which Kerberoasting expertly exploits. Silent, subtle, and persistent, this threat often goes unnoticed until significant damage occurs. Traditional defenses rely on brittle heuristics, such as one-size-fits-all thresholds that ignore behavioral differences between accounts. These thresholds are typically based on static baselines and generic anomaly-detection models, which often fail to detect attacks due to the highly variable nature of Kerberos traffic. Both of these approaches result in a large number of false positives while outright missing "low-and-slow" attacks.

By combining security research with data science, BeyondTrust developed a model that learns each account's typical ticket-request frequency and flags deviations from that norm. The result is a lightweight detection capability that can uncover even the stealthiest Kerberoasting attacks.

This blog explores the basics of a Kerberoasting attack, the limitations of traditional Kerberoasting detection methods, and walks through why our data modeling approach is able to surface the hidden threats traditional defenses miss.

Common Heuristics-Based Kerberoasting Detection Methods

Typical heuristic-based detection methods rely on static rules, such as:

• Volume-based detection: When an attack is performed, the attacker often requests TGS tickets for all service principal names associated with users in the domain. This will show a spike of TGS request activity from an account.

• Encryption type analysis: An attacker performing a Kerberoasting attack will often attempt to downgrade the encryption of requested tickets from AES to weaker supported encryption types, such as RC4 or DES. This allows an attacker to crack the hashes and easily obtain the plaintext passwords.

While these static rules can offer some detection capabilities, they come with significant limitations, such as a high false positive rate. Static detection methods also fail to account for legitimate user behavior or evolving anomalies over time. Furthermore, their efficiency can vary across organizations based on the domain configurations and associated services.

Statistical and Machine Learning Kerberoasting Detection Methods

Some other approaches for detecting Kerberoasting include:

• Supervised/Semi-supervised machine learning: This approach requires having enough (often at least a couple hundred) defined labels of past Kerberoasting attacks, a set of potential signals (or so-called features), and selecting an algorithm (there are many choices) to learn how to discriminate between labeled data points based on a defined metric.

• Unsupervised machine learning: Unlike supervised methods, this approach does not require pre-labeled data. Instead, it focuses on describing patterns within a set of signals, such as identifying groups (or clusters) based on a defined metric, or quantifying deviations (or anomalies) from normal behavior.

• Statistical modeling: This method aims to estimate a probability distribution given the available data, which can be labels, signals, or a combination of both.

Given our lack of prior Kerberoasting labels, supervised/semi-supervised learning was not feasible, nor was it aligned with our goal of identifying unusual or unknown behaviors within Event ID 4769 events that could signal such attacks. Thus, looking at the problem as anomaly detection, specifically building an automated and adaptive way of baselining and thresholding counts, became a natural progression from heuristic methods. Following our method analysis, the next critical decision was to determine the optimal modeling approach to accurately represent the statistical properties of our dataset.

While prior literature discusses the precision of certain common unsupervised learning algorithms for Kerberoasting, these types of “off-the-shelf" ML methods proved ineffective in addressing our top four constraints:

• Explainability: The ability to interpret the output with respect to a recognized, normalized, and easy to explain and track measure.

• Uncertainty: The ability to reflect sample size and confidence in estimates, as opposed to the output being a simple binary indicator.

• Scalability: The ability to limit the amount of cloud computing and data storage needed for updating model parameters per run.

• Nonstationarity: The capacity to adapt to trends or other data changes over time, and incorporating these shifts into how anomalies are defined.

Ultimately, we focused on statistical models and developed logic to balance precision requirements with the above constraints. The next section summarizes our model.

Modeling Real-World Ticket Request Patterns

Our approach to detecting Kerberoasting leverages a robust statistical framework designed to address the complexities of count data. It involves using a discrete probability model capable of addressing several challenges simultaneously, such as zero/one inflation (due to rare activity), multi-modal skewed distributions (resulting from highly variable frequency patterns), and the need to appropriately weight recent observations while discounting historical data that no longer represented current behavior patterns. Additionally, the model efficiently identifies latent clusters to refine probability estimates for infrequently active accounts that nonetheless exhibited heavy-tailed distributions.

Balancing Statistical and Practical Significance

Our methodology incorporates both statistical significance and practical significance thresholds to optimize computational resources and prioritize investigative efforts. We implemented normalized parameters to calibrate detection sensitivity based on the organizational context. For instance, in smaller enterprises, while two Kerberos service ticket requests might be statistically anomalous and four exceedingly rare, a difference of merely two units might not warrant investigative resources. Conversely, in large enterprise environments where some accounts routinely generate hundreds of ticket requests, novel activity exceeding historical patterns by 20 units but representing only a 1.1x relative increase, might fall within acceptable variance parameters and not require escalation.

Efficient Data Extraction and Processing

Scale and performance considerations guided our data extraction approach for model estimation. BeyondTrust Data Scientists carefully calibrated the amount of historical data processed during each run, balancing the need for statistical accuracy with computational efficiency in the production environment.

Dynamic Updates and Censoring for Accuracy

Our model architecture employs a sequential approach to data processing, updating parameters with each new timestamp to address the specified requirements. We implemented count censoring to filter out values below certain thresholds, which serves two important purposes: reducing computational overhead and preventing statistically rare but practically insignificant small counts from disproportionately influencing the results. This censoring mechanism is directly integrated into the probability estimations, ensuring statistical consistency throughout the modeling process.

Handling Nonstationary Behavior with Sliding Windows

Our model incorporates dynamic sliding windows to address the nonstationarity problem we discussed above. This approach balances recent frequency changes with the ability to capture infrequent extreme events that might only occur every few months for certain accounts.

Using Percentiles for Detection Control

We used high percentile statistics (P90, P95, up to P999) as our main control mechanism for the model. These percentiles helped us with three key tasks: grouping similar counts, setting decision thresholds, and interpreting results. For example, when we wanted to limit anomaly alerts to just three per month (assuming 20 operating hours per day), we chose the 99.5th percentile (P995) as our risk measurement, demonstrating why statistical modeling works so well for this problem type.

The Histogram Approach to Classic Distributions

Instead of relying on traditional statistical distributions like the negative binomial—which can yield misleading results (such as unrealistically small p-values)—we chose a simpler histogram method. We determined the histogram bin sizes using those same upper percentile thresholds. This approach led to the creation of what we call a 'sliding-window censored clustering q-statistics histogram', which is essentially a dynamic method for organizing and analyzing our data that adjusts over time.

Detecting Kerberoasting attacks poses a significant challenge in Active Directory environments because they have the ability to blend in with legitimate Kerberos traffic. BeyondTrust’s research has demonstrated that moving from traditional heuristic approaches to statistical modeling significantly improves detection capabilities while reducing false positives.

Through our collaborative approach, we have successfully combined security domain expertise with advanced statistical techniques. As researchers, we were able to provide the critical context needed to pinpoint meaningful features within relevant events. Concurrently, our statisticians developed a robust model capable of adapting to the evolving behaviors observed across many different environments. By integrating these two disciplines, we were able to develop a detection capability that can identify both known attack patterns and potential variations.

The results speak for themselves. Our model was able to efficiently process large volumes of Kerberos event data and correctly identify simulated attack scenarios while generating extremely few false positives. The model’s ability to adapt to enterprise-specific behaviors and dynamically update its baseline understanding offers a distinct advantage over static, rule-based detection methods.