Kerberos

Synopsis

Creates an emulated Kerberos Key Distribution Center that identifies AS-REQ and TGS-REQ messages, recovers the principal components they carry, and always answers with a KRB-ERROR so it looks like a real KDC to the client. Every parsed request is logged with the recovered principal information.

Schema

- id: <numeric>
  name: <string>
  description: <string>
  type: kerberos
  tags: <string[]>
  pipelines: <pipeline[]>
  status: <boolean>
  properties:
    address: <string>
    port: <numeric>
    dns_domain: <string>
    computer_name: <string>
    timeout: <numeric>

Configuration

The following fields are used to define the device:

Device

Field	Required	Default	Description
id	Y		Unique identifier
name	Y		Device name
description	N	-	Optional description
type	Y		Must be kerberos
tags	N	-	Optional tags
pipelines	N	-	Optional pre-processor pipelines
status	N	true	Enable/disable the device

Connection

Field	Required	Default	Description
address	N	"0.0.0.0"	Listen address
port	Y		Listen port
timeout	N	15	TCP connection idle timeout in seconds

note

The listener binds both UDP and TCP on the configured port. Over TCP, each message is prefixed with a 4-byte length field. The Kerberos realm answered by the device is the uppercased dns_domain — corp.local becomes CORP.LOCAL.

Realm

Field	Required	Default	Description
dns_domain	N	"corp.local"	Domain name uppercased to form the answered Kerberos realm
computer_name	N	"DC01"	Accepted for configuration consistency with the other honeypot devices

note

computer_name is accepted, and changing it reloads the device, but it does not affect any response. Only dns_domain influences behavior, by way of the realm.

Details

Emulated KDC

The device identifies the message from the ASN.1 application tag: 0x6A for AS-REQ, 0x6C for TGS-REQ. Any other tag is dropped. Rather than a full ASN.1 parse, it scans for GeneralString values to recover the principal components — username, realm, and service principal name.

It always answers with a synthesized KRB-ERROR ([APPLICATION 30], pvno 5, msg-type 30, sname of krbtgt/REALM):

Message	Error returned
AS-REQ	25 KDC_ERR_PREAUTH_REQUIRED
TGS-REQ	7 KDC_ERR_S_PRINCIPAL_UNKNOWN

AS-REQ traffic reveals attempted usernames, which is the signature of user enumeration and AS-REP roasting. TGS-REQ traffic reveals requested service principals, which is the signature of Kerberoasting.

Logged Events

Each parsed message generates one of the following event types:

event_type	Emitted when
as_req	An AS-REQ message is identified and parsed
tgs_req	A TGS-REQ message is identified and parsed

Event Fields

Every event carries timestamp, event_type, source_ip, source_port, and local_addr. The remaining fields depend on the event type:

Field	Description
transport	Transport the request arrived on: udp or tcp
msg_type	Identified message type: AS-REQ or TGS-REQ
username	First principal component recovered from the message
realm	First all-uppercase dotted principal component recovered from the message, otherwise the configured realm
principals	All principal components recovered from the message

Examples

The following are commonly used configuration types.

Basic

Creating a minimal Kerberos honeypot on the standard port...

devices: - id: 1 name: basic_kerberos type: kerberos properties: port: 88

Custom Realm

Answering as a different Active Directory realm...

devices: - id: 2 name: kerberos_custom_realm type: kerberos properties: port: 88 dns_domain: contoso.com

With Pre-Processing

Routing captured requests through a pre-processing pipeline before ingestion...	devices: - id: 3 name: kerberos_preprocessed type: kerberos pipelines: - decoy-honeypot-enrich properties: port: 88 dns_domain: corp.local
A TGS-REQ for a service principal is logged, showing a Kerberoasting-style request...	{ "timestamp": "2026-08-03T09:14:22.481937204Z", "event_type": "tgs_req", "source_ip": "203.0.113.44", "source_port": "51422", "local_addr": "10.0.4.12:88", "transport": "tcp", "msg_type": "TGS-REQ", "username": "svc-sql", "realm": "CORP.LOCAL", "principals": ["svc-sql", "CORP.LOCAL", "MSSQLSvc/sql01.corp.local:1433"] }