How do I detect Kerberoasting attacks?

Look for a single account requesting an unusually large number of service tickets in a short time, and watch for ticket requests that specify RC4-HMAC encryption instead of AES. Identity Threat Detection and Response (ITDR) tools automate this monitoring by baselining normal Kerberos request patterns and alerting on deviations.

How do I prevent Kerberoasting?

Use long, randomly generated passwords (25 or more characters) for all service accounts with SPNs, rotate those passwords regularly, and prefer Managed Service Accounts or Group Managed Service Accounts (gMSA) which rotate passwords automatically. Enforcing AES encryption for Kerberos tickets also slows offline cracking significantly.

Does Kerberoasting require admin privileges?

No. Any authenticated domain user can request service tickets for accounts with SPNs, which is what makes Kerberoasting accessible to attackers who have compromised even a low-privilege account.

What is Kerberoasting?

Q: What is Kerberoasting in Active Directory?

Kerberoasting is an attack where a domain user requests Kerberos service tickets for accounts with Service Principal Names, then cracks those tickets offline to recover the account passwords. It works against any Active Directory environment where service accounts use weak or old passwords.

Kerberoasting is an Active Directory attack technique in which an attacker requests Kerberos service tickets for accounts with registered Service Principal Names, then cracks those tickets offline to recover plaintext service account passwords. It requires no special privileges to execute and succeeds when service accounts use weak or non-rotating passwords.

What it is

Kerberoasting exploits a design feature of the Kerberos authentication protocol used in Microsoft Active Directory environments. Any authenticated domain user can request a service ticket for any account that has a Service Principal Name (SPN) registered. That ticket is encrypted with the service account's password hash. The attacker takes the encrypted ticket off the network and runs a password-cracking tool against it locally, with no further interaction with the domain controller required.

The attack has four steps:

Authenticate to the domain as any low-privilege user.
Query Active Directory for accounts with SPNs.
Request service tickets for those accounts.
Export the tickets and crack them offline using tools such as Hashcat or John the Ripper.

Service accounts are frequent targets because they often hold elevated privileges, rarely have their passwords rotated, and are sometimes configured with simple passwords set years ago.

Why it matters

A successful Kerberoasting attack can give an attacker credentials for a service account that has local administrator rights, database access, or the ability to move laterally across the environment. Because the cracking happens offline, there are no failed login attempts to trigger account lockout policies. Detection requires monitoring Kerberos ticket request patterns, not login failures.

How tools address it

Identity Threat Detection and Response (ITDR) platforms address Kerberoasting by:

Detecting abnormal volumes of service ticket requests from a single account.
Flagging requests for tickets using weak encryption types (RC4-HMAC instead of AES), which attackers prefer because RC4 hashes crack faster.
Identifying service accounts with SPNs that have not had their passwords rotated recently.

What is Kerberoasting?

What it is

Why it matters

How tools address it

Common confusions

Identity Threat Detection and Response tools

Frequently asked questions