Kerberoasting is a quiet path from any domain user to service-account credentials - no exploit, no admin needed.
How it works
- In Active Directory, accounts with a Service Principal Name (SPN) can be requested via Kerberos TGS.
- Any authenticated user can ask for a service ticket for those SPNs.
- Part of that ticket is encrypted with the service account's password hash.
- The attacker takes the ticket offline and cracks it with hashcat/John. Weak or RC4 passwords fall fast.
The attacker never touches the target service - which is exactly why it's stealthy.
How to detect it
- Event ID 4769 (Kerberos service ticket requested). Baseline normal volume, then alert on:
- A single account requesting many different SPNs in a short window.
- Requests using RC4 encryption (
0x17) where AES is expected - a downgrade tell.
- Honeypot SPN accounts - create a service account no one should ever request; any 4769 for it is high-signal.
How to prevent it
- Use group Managed Service Accounts (gMSA) or long, random service passwords.
- Retire RC4 where possible; enforce AES.
- Hunt the follow-on: an account that gets cracked then suddenly performs privileged logons.