Kerberoasting: SPN ticket cracking attacks

Kerberoasting is an Active Directory attack technique that exploits the Kerberos authentication protocol to crack service account credentials offline. The attack targets Service Principal Names (SPNs) registered in Active Directory. Any authenticated domain user can request a Kerberos TGS ticket for any SPN without special privileges. That ticket is encrypted with the NTLM hash of the service account password. The attacker extracts the ticket from memory and performs offline brute-force or dictionary attacks against it. No elevated rights are needed to perform the initial request. This makes Kerberoasting particularly dangerous in environments where service accounts use weak or non-rotated passwords. The attack was formalized around 2014 and remains one of the most effective lateral movement and privilege escalation paths in Active Directory environments. Service accounts often hold elevated privileges — some are even domain admins — making successful cracking highly impactful. The technique is entirely passive from a network perspective during the cracking phase, which makes it hard to detect without proper event log monitoring.

Detection relies primarily on Windows Security event logs. Event ID 4769 (Kerberos Service Ticket Operations) is the key indicator. Analysts should filter for tickets requested with encryption type 0x17 (RC4-HMAC), since modern environments should use AES 256 (0x12 or 0x13). A single user account requesting TGS tickets for multiple SPNs in a short time window is a strong behavioral indicator. SIEM rules should alert on high-volume 4769 events from a single source IP or account within minutes. SPN enumeration activity — often visible in LDAP query logs or via tools like BloodHound — can precede the ticket requests. Microsoft Defender for Identity (formerly ATA) has built-in Kerberoasting detection based on these patterns. Honeypot service accounts with SPNs and no legitimate callers are an effective deception technique. Any TGS request targeting such an account triggers an immediate high-confidence alert. Baseline normal SPN request behavior per user to reduce false positives in high-traffic environments.

Red teamers typically begin by enumerating SPNs using PowerShell or LDAP queries. Tools like Invoke-Kerberoast (PowerSploit), Rubeus, or Impacket's GetUserSPNs.py automate both enumeration and ticket extraction. Rubeus is favored in modern engagements because it operates entirely in memory and avoids touching disk. Extracted tickets are saved in hashcat-compatible format (mode 13100 for RC4, 19600/19700 for AES). Hashcat with wordlists and rules cracks weak passwords efficiently offline. To harden against Kerberoasting, enforce Managed Service Accounts (MSA) or Group Managed Service Accounts (gMSA), which rotate passwords automatically with 256-bit complexity. For standard service accounts, enforce passwords of at least 25 characters with high entropy. Audit all SPNs regularly and remove unused ones. Enabling AES-only encryption for service accounts forces attackers to crack stronger hashes, significantly increasing cracking time. Tiering privileged service accounts and monitoring their usage with PAM solutions further limits blast radius if credentials are compromised.