Service Account Abuse Detection

What This Means

Detect unauthorized use of service accounts in your environment. Identify stolen service credentials, Kerberoasting targets, and service account misuse for lateral movement.

Example Log

An account was successfully logged on.
Account Name: svc_backup
Logon Type: 3
Source Network Address: 10.0.9.55
Authentication Package: NTLM

-- Note: svc_backup should only authenticate from BACKUP01 (10.0.1.10)

Indicators of Suspicious Activity

• Service account authenticating from unexpected workstations or servers
• Interactive logon (Type 2 or 10) for accounts that should only use Type 5 (service)
• Service account used to access resources outside its designated scope
• NTLM authentication for service accounts that should use Kerberos
• Service account activity outside its normal operational schedule
• Failed logon attempts against service accounts from unusual sources

How to Investigate

1. Document the intended scope of each service account (what host, what service, what time)
2. Compare current authentication patterns against the documented scope
3. Check if the service accounts password was recently changed
4. Review Kerberos ticket requests (Event 4769) for the service account SPN
5. Determine if any lateral movement occurred from the authenticating workstation
6. Verify the service account has not been added to privileged groups

Recommended Mitigations

• Implement Group Managed Service Accounts (gMSA) with auto-rotating passwords
• Restrict service account logon to specific computers using logon restrictions
• Deny interactive and remote interactive logon for all service accounts
• Monitor service account authentication and alert on any deviation from baseline
• Rotate service account passwords on a 90-day cycle
• Audit service accounts quarterly for unnecessary privileges and scope creep

Related Log Types

Related Attack Patterns

Frequently Asked Questions