performing-kerberoasting-attack

SUSPICIOUS/HIGH-RISK but not confirmed malware. The skill is internally consistent with its stated red-team purpose and shows no direct exfiltration or malicious installer path, but its actual function is to give an AI agent offensive credential-theft capability in Active Directory. Risk is driven mainly by enabling post-exploitation and credential access, not by hidden behavior.

This module is a high-risk offensive security utility rather than benign software: it performs authenticated LDAP-based SPN enumeration and generates Kerberoasting/cracking workflow artifacts. While it lacks stealth/exfiltration/backdoor behavior in the shown fragment, it directly facilitates credential attacks and leaks the user-supplied plaintext password into command strings printed/returned to the console, which increases operational and logging risk. Treat as security-sensitive and restrict usage to authorized red-team contexts with careful handling of credentials and output paths.

High-confidence supply-chain security finding: this module is an offensive Kerberoasting tool. It enumerates SPNs, requests TGS tickets via impacket with '-request', writes captured Kerberos hashes to '/tmp/kerberoast_hashes.txt', and analyzes/detects Kerberoasting-related events (Event ID 4769, RC4/0x17). There is no obfuscation to conceal behavior; the malicious intent is explicit. If this were a dependency of a larger project, it would be a severe security risk and should be reviewed/removed/isolated, especially because it can harvest credential material and execute powerful OS/AD queries.

The fragment is an explicitly offensive Kerberoasting and post-exploitation playbook. It covers SPN enumeration and Kerberos TGS harvesting, exports crackable material, performs offline password cracking (hashcat/john), and uses recovered credentials for authenticated validation and secrets dumping. It also includes OPSEC/evasion guidance, which further supports malicious intent. Even without obfuscation, the actionable nature and credential-theft focus present an extremely high security risk.

Based on the provided description alone, this package is an end-to-end Kerberoasting agent: it enumerates SPN-enabled accounts in AD, requests TGS tickets to extract $krb5tgs$ hashes suitable for offline cracking, and optionally detects Kerberoasting indicators from EVTX (Event ID 4769 with suspicious encryption-type/RC4 signals). This is high-risk offensive functionality consistent with credential-access tooling. No explicit obfuscation or stealth behaviors are shown in the outline, but absence of the actual code limits verification of additional malicious behaviors (e.g., exfiltration/persistence). Treat as potentially harmful if encountered in a supply-chain context unless there is clear, documented authorization and legitimate defensive use-case.