What is Kerberoasting?

Kerberoasting is an attack technique against Kerberos service accounts in Active Directory. A normal authenticated domain user can request a service ticket for a Service Principal Name (SPN). Part of that ticket is protected by a key derived from the service account password, allowing offline password guessing.

Why is it dangerous?

Ticket requests are expected Kerberos behavior and usually need no elevated rights. Guessing happens offline, beyond login rate limits and lockouts. A weak, old and privileged service account password can lead to privilege escalation and lateral movement.

Simplified sequence

1. The attacker controls a normal domain account.
2. They enumerate accounts with SPNs and their privileges.
3. They request normal TGS tickets for selected services.
4. Ticket material is checked against candidates offline.
5. A recovered password grants the service account's rights.

Prevention

• - Prefer group Managed Service Accounts (gMSA) with long automatically rotated passwords.
• - Use long random passwords and managed rotation for unavoidable classic accounts.
• - Minimize privileges, deny interactive login and avoid Domain Admin membership.
• - Reduce legacy RC4 and configure AES; strong passwords remain necessary.
• - Regularly inventory SPNs, age, delegation and effective privileges.

Detection

Windows event 4769 records TGS requests. Signals include many SPNs in a short interval, RC4 in an AES-capable environment, unusual source hosts and correlation with directory enumeration. Individual tickets are normal, so detection needs a baseline and account/device/service context.

Useful open-source tools

Impacket supports authorized SPN and ticket testing. BloodHound visualizes privilege and service-account paths. Defenders can apply Sigma rules to 4769 events. These tools expose sensitive domain data and belong only in scoped assessments and protected analysis environments.