How to Investigate a Compromised Active Directory Service Account

Confirm the account is compromised:

Detection signals that indicate service account compromise:

• SIEM alert for Kerberoasting (Event ID 4769, RC4 encryption, SPN-registered account)
• EDR alert for process using the account in an unusual context
• Threat intel notification (credentials found in underground forum)
• Login alert from unusual IP, time, or geolocation for the account
• Failed authentication to a system the account should not access

# Check the account's current status and recent activity
Get-ADUser -Identity svc-webapp -Properties * | 
  Select-Object SamAccountName, Enabled, PasswordLastSet, LastLogonDate,
                PasswordNeverExpires, ServicePrincipalNames

# Check password age: Kerberoasted accounts often have old passwords
$pwAge = (Get-Date) - (Get-ADUser svc-webapp -Properties PasswordLastSet).PasswordLastSet
Write-Host "Password age: $($pwAge.Days) days"
# > 90 days: elevated crack risk
# > 365 days: high risk that the hash has been cracked

Determine what the account has access to:

# Find all group memberships (including nested)
Get-ADUser -Identity svc-webapp -Properties MemberOf | 
  Select-Object -ExpandProperty MemberOf | 
  ForEach-Object { (Get-ADGroup $_).Name }

# Check for direct ACL grants on sensitive objects
# (BloodHound is better for this: see the BloodHound article)
Get-ADUser -Identity svc-webapp | 
  ForEach-Object { (Get-Acl "AD:\$($_.DistinguishedName)").Access } |
  Where-Object IdentityReference -match 'svc-webapp'

# Find service principal names (what services use this account)
Get-ADUser -Identity svc-webapp -Properties ServicePrincipalNames | 
  Select-Object -ExpandProperty ServicePrincipalNames
# MSSQLSvc/sqlserver.corp.local:1433 → account runs SQL Server
# HTTP/webapp.corp.local → account runs an IIS application pool

Check for Kerberoasting (most common for SPN-registered accounts):

# Check if the account has SPNs (Kerberoastable)
(Get-ADUser svc-webapp -Properties ServicePrincipalNames).ServicePrincipalNames
# If not empty → the account was Kerberoastable

# Check Event ID 4769 on DCs for RC4 ticket requests targeting this account
Get-WinEvent -ComputerName dc01 -FilterHashtable @{
  LogName = 'Security'
  Id = 4769
  StartTime = (Get-Date).AddDays(-30)
} | Where-Object {
  $_.Properties[0].Value -eq 'svc-webapp' -and  # Service name matches
  $_.Properties[5].Value -eq '0x17'  # RC4 encryption type
} | Select-Object TimeCreated, @{n='Client';e={$_.Properties[9].Value}},
    @{n='ClientIP';e={$_.Properties[10].Value}}

Check for password spray or brute force:

# Look for failed logon attempts (4625) for the account in the past 30 days
Get-WinEvent -ComputerName dc01 -FilterHashtable @{
  LogName = 'Security'
  Id = 4625
  StartTime = (Get-Date).AddDays(-30)
} | Where-Object { $_.Properties[5].Value -eq 'svc-webapp' } |
  Group-Object @{e={$_.Properties[19].Value}} |  # Group by source IP
  Sort-Object Count -Descending | Select-Object -First 10

Check for credential dumping on hosts where the service runs:

// Sentinel: check for LSASS access on hosts running the service (Sysmon Event 10)
SysmonEvent
| where EventID == 10
| where TargetImage endswith "lsass.exe"
| where Computer in ("sqlserver", "webapp01", "webapp02")  // Hosts where svc-webapp runs
| where TimeGenerated > ago(30d)
| project TimeGenerated, Computer, SourceImage, GrantedAccess

Authentication timeline: what systems did the account access:

# Query all authentication events for the service account across all DCs
# Focus on logons from unexpected source IPs or at unexpected times

$startTime = (Get-Date).AddDays(-30)
$domainControllers = (Get-ADDomainController -Filter *).Hostname

$logons = foreach ($dc in $domainControllers) {
  Get-WinEvent -ComputerName $dc -FilterHashtable @{
    LogName = 'Security'
    Id = @(4624, 4648)
    StartTime = $startTime
  } -ErrorAction SilentlyContinue | Where-Object {
    $_.Properties[5].Value -eq 'svc-webapp' -or  # Event 4624
    $_.Properties[1].Value -eq 'svc-webapp'       # Event 4648
  } | Select-Object TimeCreated,
    @{n='Event';e={$_.Id}},
    @{n='LogonType';e={$_.Properties[8].Value}},
    @{n='SourceIP';e={if ($_.Id -eq 4624) {$_.Properties[18].Value} else {$_.Properties[12].Value}}},
    @{n='TargetServer';e={if ($_.Id -eq 4648) {$_.Properties[9].Value} else {'N/A'}}},
    @{n='DC';e={$dc}}
}

# Identify anomalous source IPs
$logons | Group-Object SourceIP | Sort-Object Count -Descending
# Expected: the servers running the svc-webapp service
# Unexpected: workstations, external IPs, admin machines that never use this account

KQL: build authentication timeline in Sentinel:

SecurityEvent
| where EventID in (4624, 4648, 4625)
| where AccountName == "svc-webapp"
| where TimeGenerated > ago(30d)
| project
    TimeGenerated,
    EventID,
    LogonType,
    IpAddress,
    TargetServerName,
    Computer
| sort by TimeGenerated asc
// Look for: source IPs outside the expected service hosts
// Logon types: 3 (network) or 10 (RDP) from unexpected sources = lateral movement

Check for actions performed using the account:

# If the account has database access: check DB audit logs
# SQL Server: Look for logins and queries from unusual hosts
Invoke-Sqlcmd -ServerInstance sqlserver -Query "
  SELECT login_name, host_name, program_name, login_time, last_request_time
  FROM sys.dm_exec_sessions
  WHERE login_name = 'CORP\svc-webapp'
  ORDER BY login_time DESC"

# If the account has Azure/AWS access: check cloud logs
Get-AzLog -StartTime (Get-Date).AddDays(-30) | 
  Where-Object { $_.Claims['http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn'] -match 'svc-webapp' }

Rotating a service account password requires updating every system that uses it. Rotating before identifying all consumers breaks services: but every minute without rotation extends attacker access.

Find all systems using the service account:

# Find Windows services running as this account across the domain
# Requires admin access to each server
$servers = Get-ADComputer -Filter * -Properties OperatingSystem |
  Where-Object OperatingSystem -match 'Server' | 
  Select-Object -ExpandProperty Name

$serviceMap = foreach ($server in $servers) {
  Get-CimInstance -ComputerName $server -ClassName Win32_Service \
    -ErrorAction SilentlyContinue | 
    Where-Object StartName -match 'svc-webapp' |
    Select-Object @{n='Server';e={$server}}, Name, DisplayName, StartName, State
}

$serviceMap | Format-Table -AutoSize

# Also check:
# IIS application pools (look for the account in IIS Manager)
# Scheduled tasks
$tasks = foreach ($server in $servers) {
  (Get-ScheduledTask -CimSession $server -ErrorAction SilentlyContinue) | 
    Where-Object { $_.Principal.UserId -match 'svc-webapp' } |
    Select-Object @{n='Server';e={$server}}, TaskName
}

Rotate the password:

# Generate a strong random password
$newPw = [System.Web.Security.Membership]::GeneratePassword(32, 8)
$secPw = ConvertTo-SecureString $newPw -AsPlainText -Force

# Rotate the AD password
Set-ADAccountPassword -Identity svc-webapp -NewPassword $secPw -Reset

# Immediately update all services found above
foreach ($service in $serviceMap) {
  Invoke-Command -ComputerName $service.Server -ScriptBlock {
    $svc = Get-Service -Name $using:service.Name
    $svc | Set-Service -Credential (New-Object PSCredential('CORP\svc-webapp', $using:secPw))
    $svc | Restart-Service -Force
  }
}

# Better long-term solution: migrate to gMSA
# gMSA rotates its own password automatically (120 chars)
# No need for manual rotation after migration
New-ADServiceAccount -Name gMSA-webapp \
  -DNSHostName webapp.corp.local \
  -PrincipalsAllowedToRetrieveManagedPassword webapp-servers-sg

Post-rotation verification:

# Verify all services restarted successfully with new credentials
foreach ($service in $serviceMap) {
  $status = Get-Service -ComputerName $service.Server -Name $service.Name
  Write-Host "$($service.Server) / $($service.Name): $($status.Status)"
}

# Monitor for authentication failures with the old password hash
# (Attacker trying to use the old credentials)
# Event ID 4625 with the account name after rotation = attacker still trying