AS-REP Roasting

Detect AS-REP Roasting Attempts (T1558.004)

Audit: Auditing is the process of recording activity and systematically reviewing and analyzing the activity and system configurations. The primary purpose of auditing is to detect anomalies and identify potential threats or weaknesses in the environment. Proper auditing configurations can also help to meet compliance requirements. The process of auditing encompasses regular analysis of user behaviors and system logs in support of proactive security measures.

Auditing is applicable to all systems used within an organization, from the front door of a building to accessing a file on a fileserver. It is considered more critical for regulated industries such as, healthcare, finance and government where compliance requirements demand stringent tracking of user and system activates.This mitigation can be implemented through the following measures:

System Audit:

• Use Case: Regularly assess system configurations to ensure compliance with organizational security policies.
• Implementation: Use tools to scan for deviations from established benchmarks.

Permission Audits:

• Use Case: Review file and folder permissions to minimize the risk of unauthorized access or privilege escalation.
• Implementation: Run access reviews to identify users or groups with excessive permissions.

Software Audits:

• Use Case: Identify outdated, unsupported, or insecure software that could serve as an attack vector.
• Implementation: Use inventory and vulnerability scanning tools to detect outdated versions and recommend secure alternatives.

Configuration Audits:

• Use Case: Evaluate system and network configurations to ensure secure settings (e.g., disabled SMBv1, enabled MFA).
• Implementation: Implement automated configuration scanning tools like SCAP (Security Content Automation Protocol) to identify non-compliant systems.

Network Audits:

• Use Case: Examine network traffic, firewall rules, and endpoint communications to identify unauthorized or insecure connections.
• Implementation: Utilize tools such as Wireshark, or Zeek to monitor and log suspicious network behavior.

Password Policies: Set and enforce secure password policies for accounts to reduce the likelihood of unauthorized access. Strong password policies include enforcing password complexity, requiring regular password changes, and preventing password reuse. This mitigation can be implemented through the following measures:

Windows Systems:

• Use Group Policy Management Console (GPMC) to configure:
  • Minimum password length (e.g., 12+ characters).
  • Password complexity requirements.
  • Password history (e.g., disallow last 24 passwords).
  • Account lockout duration and thresholds.

Linux Systems:

• Configure Pluggable Authentication Modules (PAM):
• Use pam_pwquality to enforce complexity and length requirements.
• Implement pam_tally2 or pam_faillock for account lockouts.
• Use pwunconv to disable password reuse.

Password Managers:

• Enforce usage of enterprise password managers (e.g., Bitwarden, 1Password, LastPass) to generate and store strong passwords.

Password Blacklisting:

• Use tools like Have I Been Pwned password checks or NIST-based blacklist solutions to prevent users from setting compromised passwords.

Regular Auditing:

• Periodically audit password policies and account configurations to ensure compliance using tools like LAPS (Local Admin Password Solution) and vulnerability scanners.

Tools for Implementation

Windows:

• Group Policy Management Console (GPMC): Enforce password policies.
• Microsoft Local Administrator Password Solution (LAPS): Enforce random, unique admin passwords.

Linux/macOS:

• PAM Modules (pam_pwquality, pam_tally2, pam_faillock): Enforce password rules.
• Lynis: Audit password policies and system configurations.

Cross-Platform:

• Password Managers (Bitwarden, 1Password, KeePass): Manage and enforce strong passwords.
• Have I Been Pwned API: Prevent the use of breached passwords.
• NIST SP 800-63B compliant tools: Enforce password guidelines and blacklisting.

Encrypt Sensitive Information: Protect sensitive information at rest, in transit, and during processing by using strong encryption algorithms. Encryption ensures the confidentiality and integrity of data, preventing unauthorized access or tampering. This mitigation can be implemented through the following measures:

Encrypt Data at Rest:

• Use Case: Use full-disk encryption or file-level encryption to secure sensitive data stored on devices.
• Implementation: Implement BitLocker for Windows systems or FileVault for macOS devices to encrypt hard drives.

Encrypt Data in Transit:

• Use Case: Use secure communication protocols (e.g., TLS, HTTPS) to encrypt sensitive data as it travels over networks.
• Implementation: Enable HTTPS for all web applications and configure mail servers to enforce STARTTLS for email encryption.

Encrypt Backups:

• Use Case: Ensure that backup data is encrypted both during storage and transfer to prevent unauthorized access.
• Implementation: Encrypt cloud backups using AES-256 before uploading them to Amazon S3 or Google Cloud.

Encrypt Application Secrets:

• Use Case: Store sensitive credentials, API keys, and configuration files in encrypted vaults.
• Implementation: Use HashiCorp Vault or AWS Secrets Manager to manage and encrypt secrets.

Database Encryption:

• Use Case: Enable Transparent Data Encryption (TDE) or column-level encryption in database management systems.
• Implementation: Use MySQL’s built-in encryption features to encrypt sensitive database fields such as social security numbers.