Kerberoasting

Summary

Kerberoasting is a post-exploitation attack technique targeting service accounts in Active Directory environments by extracting and cracking service ticket hashes to obtain plaintext credentials.

Key Characteristics

• Targets Kerberos service tickets (TGS) associated with service accounts.
• Exploits the ability of any authenticated user to request service tickets for service principal names (SPNs).
• Extracts encrypted ticket hashes from memory or network traffic for offline password cracking.
• Allows attackers to escalate privileges by compromising service account credentials.
• Commonly used in lateral movement and persistence strategies within corporate networks.

Defensive Controls

• Enforce strong, complex, and regularly rotated service account passwords.
• Limit the number of service accounts with high privileges and restrict SPN assignments.
• Implement monitoring and alerting for unusual Kerberos ticket requests and ticket extraction activities.
• Use Managed Service Accounts or Group Managed Service Accounts to reduce password exposure.
• Deploy endpoint detection and response (EDR) tools to detect abnormal access and credential dumping behaviors.

Related Security Solutions

Kerberoasting mitigation involves Active Directory security tools, privileged access management (PAM) solutions, password auditing and management software, endpoint detection and response (EDR) platforms, and network monitoring systems capable of analyzing Kerberos traffic.