Kerberoasting

Kerberoasting is a well-known attack against Active Directory environments that abuses a legitimate feature of the Kerberos authentication protocol. It lets an attacker who already has any valid domain account recover the plaintext passwords of service accounts, often without triggering obvious alerts, and is one of the first techniques a tester or intruder tries after gaining an initial foothold.

The attack works because of how Kerberos issues service tickets. Any authenticated user can request a Ticket Granting Service ticket for an account that has a Service Principal Name registered, and part of that ticket is encrypted with a key derived from the service account’s password. The attacker requests these tickets, extracts them from memory or the network, and then attempts to crack them offline using a wordlist or brute force. Crucially, the cracking happens away from the domain controller, so it generates no failed-logon events.

Service accounts are attractive targets because they are frequently configured with weak or non-expiring passwords, are often members of privileged groups, and may have been created years earlier under looser standards. Recovering one service account password can therefore hand an attacker significant privilege, and in poorly managed domains it can be a direct route to domain administrator.

Kerberoasting sits in the credential-access phase of the MITRE ATT&CK framework and is commonly chained with lateral movement and privilege escalation. It is popular precisely because it is quiet: the ticket requests look like normal Kerberos traffic, and the resource-intensive cracking step happens on the attacker’s own hardware.

Defences focus on making the recoverable secrets useless. The most effective control is strong, long, randomly generated passwords for service accounts, ideally managed as group Managed Service Accounts so that passwords rotate automatically and are never known to a human. Reducing the number of accounts with Service Principal Names, applying least privilege so service accounts are not over-permissioned, and monitoring for anomalous volumes of service-ticket requests all raise the cost of the attack.

Kerberoasting has remained relevant for years because the underlying feature cannot simply be switched off without breaking Kerberos authentication. Defence therefore focuses on making the recoverable secrets worthless: long, random, automatically rotated passwords for service accounts remove the offline-cracking payoff entirely. Detecting anomalous volumes of service-ticket requests provides a secondary signal, but strong service-account credentials are the control that actually defeats the attack.

Because kerberoasting reflects exactly what a real attacker attempts after compromising a single user, it is a standard component of any thorough internal network or Active Directory penetration test. A test that identifies kerberoastable accounts with weak passwords shows an organisation precisely which service accounts an attacker could crack, and what privileges cracking them would grant, so the specific weak credentials can be strengthened before they are exploited.

Kerberoasting is a standard part of any thorough internal network or Active Directory penetration test, because it reflects exactly what an attacker does after phishing a single user. Precursor tests for kerberoastable accounts and weak service-account passwords as part of internal network engagements, and reports the specific accounts and privileges at risk.