TL;DR: Ghost SPNs can let a low-privilege domain user reflect Kerberos authentication back to a target host and reach SYSTEM-level access when SMB signing is not enforced, according to Semperis. The issue shows that SPN hygiene, DNS write permissions, and protocol hardening still determine whether relay-style attacks remain viable.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Semperis's research: Ghost SPNs in Active Directory can let Kerberos reflection turn a misresolved service principal into remote SYSTEM-level access through SMB.
Why it matters: It matters because AD permissions, SPN hygiene, and SMB hardening together shape whether a low-privilege account can pivot into machine-level control, which is a direct identity governance issue for Windows estates.
Context
Ghost SPNs are service principal names that point to hostnames which no longer resolve in DNS, or never resolved correctly in the first place. In Active Directory, that creates a hidden authentication path that can be abused if the surrounding permissions and protocol settings are weak.
The identity governance problem is not Kerberos alone, but the combination of stale SPN records, default DNS write permissions, and missing SMB signing. When those conditions align, a standard domain user can shape authentication flow in ways the programme did not intend.
Semperis describes this as a remote privilege escalation path that still exists on Windows systems unless the hardening controls are in place. The pattern is familiar in AD environments where lifecycle cleanup and protocol enforcement drift apart.
Key questions
Q: What breaks when a Ghost SPN is left in Active Directory?
A: A stale SPN can become an authentication target even though the host it names no longer exists. If an attacker can register the name in DNS and the target does not enforce SMB signing, Kerberos authentication can be reflected back to the machine and used to obtain SYSTEM-level access.
Q: Why does this Ghost SPN issue create privilege-escalation risk?
A: Because the authentication exchange is not just proving identity, it is also carrying trust about where the service lives. When a user can redirect that name resolution and the server accepts unsigned SMB traffic, the machine account can be abused as an elevation path instead of a boundary.
Q: What signs suggest Kerberos reflection is being attempted in a Windows environment?
A: Look for unusual TGS requests to HOST or CIFS SPNs that do not match a known service endpoint, especially when the target hostname is unresolved or recently changed. You should also treat unexpected DNS updates from standard users as a strong signal that the authentication path may be under manipulation.
Q: How should teams respond when SMB signing is not enforced on domain-joined systems?
A: Treat the environment as relay-capable until proven otherwise. Prioritise host groups that expose HOST or CIFS SPNs, remove unresolved SPNs, and tighten DNS write permissions so attackers cannot combine name control with unsigned authentication.
Technical breakdown
How Ghost SPNs create a reflection target
A Ghost SPN is an SPN that maps to a hostname the environment cannot resolve. That matters because Kerberos service tickets are issued against the SPN and then presented back to the target service. If the SPN exists in AD but the name is not tied to a real, governed host, an attacker can register the name in DNS and steer the target toward an endpoint they control. The weakness is not ticket issuance itself. It is that the identity metadata still authorises a service path that no longer corresponds to a valid machine boundary.
Practical implication: Prune unresolved SPNs and tie service principal records to live host ownership so reflected authentication cannot be redirected.
Why SMB signing changes the attack outcome
SMB signing prevents a relay from tampering with or reusing the authentication exchange in the way this attack requires. In the Ghost SPN scenario, the attacker relies on capturing the Kerberos AP-REQ and replaying it back to the target service. If SMB signing is enforced, the target can reject the unauthorised exchange because the message integrity chain no longer matches the expected session. This is why the attack works across Windows versions when signing is absent, but fails when the protocol is hardened at the server side.
Practical implication: Require SMB signing on all domain-joined systems, not only on domain controllers, to remove the relay path.
How default DNS permissions extend identity risk
By default, standard domain users can often register DNS records. That permission is not harmless when combined with a Ghost SPN, because it lets an unprivileged user make a dead SPN look reachable and place it on an attacker-controlled IP. The result is an identity-to-network bridge that converts a naming problem into an authentication abuse path. The important control boundary here is not just access to AD objects, but who can influence name resolution for security-relevant service endpoints.
Practical implication: Restrict DNS record creation and review who can alter records that affect service authentication paths.
Threat narrative
Attacker objective: To convert a low-privilege domain foothold into SYSTEM access on a target Windows machine and, in some cases, broader domain compromise.
- The attacker identifies a Ghost SPN on a domain-joined Windows host and confirms that SMB signing is not enforced.
- The attacker registers a DNS record for the dead SPN and points it to an attacker-controlled endpoint.
- The target host authenticates to that endpoint, the Kerberos ticket is relayed back to the service, and the machine account is accepted as SYSTEM.
- The attacker executes commands with elevated privileges and can extend the impact to domain compromise if the host is a Tier 0 asset.
Breaches seen in the wild
- Malwarebytes breach 2021: SolarWinds attackers added a certificate to a dormant email security app's service principal at Malwarebytes and read internal email via Microsoft Graph.
- Azure Key Vault Contributor escalation 2024: Datadog found Azure Key Vault Contributor could add itself to access policies and read every secret, key and certificate in a vault.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Ghost SPNs create an identity control gap, not just a naming defect: The exploit works because an SPN can outlive the hostname it was meant to represent. That leaves AD with a live authentication object that no longer matches a real service boundary. The practitioner consequence is that SPN lifecycle hygiene is an identity control, not a housekeeping task.
SMB signing is the policy boundary that decides whether Kerberos reflection stays theoretical: Without it, the attacker can replay the authentication exchange back to the target and ride the machine account into SYSTEM. That means protocol hardening is part of identity governance for Windows workloads, not just transport security. Teams that treat SMB signing as optional are leaving a relay path open by design.
Default DNS write permissions are a privilege-escalation enabler for standard users: When ordinary domain users can register records for security-relevant names, they can transform a stale SPN into an active attack path. The broader lesson is that delegated DNS control has identity impact whenever it influences authentication routing. Practitioners should treat DNS write scope as part of privileged access design.
SPN hygiene should be managed as a governed lifecycle, not an occasional audit: The article shows that legacy hosts, pre-staged services, typos, and hybrid edge cases all create ghost records that can become exploitable later. Ghost SPN lifecycle drift: when service names survive after the host they describe is gone, authentication trust detaches from asset reality. The implication is continuous ownership and cleanup, not one-off remediation.
Kerberos reflection remains a structural abuse pattern whenever the trust path is allowed to loop back to the source: Microsoft fixed one implementation path in SMB, but the article makes clear that the underlying weakness is broader than a single CVE. That puts the burden on practitioners to assume that any service using unresolved or misbound SPNs may still be a relay candidate. The safest posture is to govern the trust path, not just chase one patch.
What this signals
Ghost SPN lifecycle drift: unresolved service names should be treated as live identity debt, because they preserve an authentication path after the host they describe has disappeared. That makes SPN ownership, cleanup, and DNS control part of the same governance problem.
Windows identity programmes should assume that protocol hardening and directory hygiene are coupled. If SMB signing is optional and DNS writes are broadly delegated, a low-privilege account can turn metadata drift into privilege escalation without touching a password or token.
The practical signal is simple: if your SPN estate contains unresolved names, your authentication boundary may already be softer than your access model claims. The governance answer is to align service identity ownership with asset reality and to remove trust paths that can loop back to the target.
For practitioners
- Enforce SMB signing everywhere Make SMB signing mandatory on all domain-joined machines so relay-style Kerberos abuse cannot succeed through an unsigned session.
- Audit and remove Ghost SPNs Inventory SPNs that point to unresolved or decommissioned hosts, then correct or delete them before they become a reflection target.
- Restrict DNS record creation Remove the default ability for standard users to register arbitrary DNS records, especially where those records can influence authentication paths.
- Monitor suspicious Kerberos service tickets Flag unusual TGS requests for HOST or CIFS SPNs that do not map cleanly to a known asset or expected service owner.
- Limit coercion entry points Patch known coercion vectors and disable unnecessary services such as Print Spooler on systems that do not require them.
Key takeaways
- Ghost SPNs turn stale service metadata into a live authentication target when DNS and SMB controls are weak.
- Semperis ties the issue to CVE-2025-58726 and shows that it can still bypass the earlier CVE-2025-33073 fix.
- The limiting controls are SPN cleanup, DNS write restriction, and mandatory SMB signing across domain-joined systems.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-07 — Long-Lived Secrets | Ghost SPNs persist after the host they reference disappears, creating stale identity trust. |
| NHI-05 — Overprivileged NHI | Default DNS write rights let standard users influence authentication routing beyond their role. | |
| Recommendation — Track and remove orphaned SPNs before they remain usable as authentication targets. Reduce DNS write scope so ordinary users cannot steer service authentication paths. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | The attack relays Kerberos authentication to gain SYSTEM and move through the host boundary. |
| Recommendation — Map Ghost SPN abuse to credential access and lateral movement hunts in your detection pipeline. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | The issue depends on managing authentication material and its trust path correctly. |
| Recommendation — Apply authenticator management controls to remove stale identity bindings and lock down relay paths. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | DNS write rights and SPN ownership are entitlement problems at the identity boundary. |
| Recommendation — Review permissions that let standard users alter authentication-relevant records. | ||
Key terms
- Ghost SPN: A Ghost SPN is a service principal name in Active Directory that points to a hostname that no longer resolves in DNS. It matters because the identity record still exists and can be abused to redirect authentication, even when the underlying service is gone.
- Kerberos reflection: Kerberos reflection is an abuse pattern where an attacker captures an authentication attempt and replays it back to the victim’s own service. In Windows environments, it can turn a legitimate machine authentication into privileged access when signing and relay protections are weak.
- SMB signing: SMB signing adds integrity protection to SMB messages so they cannot be altered or relayed without detection. In this context it is a trust boundary control, because unsigned sessions can accept reflected authentication material that should never have been reusable.
- SPN hygiene: SPN hygiene is the practice of keeping service principal names accurate, resolvable, owned, and aligned to real service endpoints. It matters because stale or misbound SPNs can outlive the systems they describe and become authentication abuse paths.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 24, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org