Kerberoasting

Kerberoasting is a post-exploitation attack technique that targets Active Directory (AD) environments by exploiting the Kerberos authentication protocol. Attackers extract encrypted service account credentials and crack them offline to gain privileged access. This method is particularly dangerous because it leverages legitimate Kerberos functionality, making it difficult to detect and requiring only minimal privileges to execute.

Key Points

• Targets service accounts with Service Principal Names (SPNs) that often have elevated privileges
• Exploits the Ticket Granting Service (TGS) to obtain encrypted credentials without triggering authentication failures
• Uses offline brute-force attacks to crack passwords, avoiding real-time detection mechanisms
• Requires only basic domain user access to execute, lowering the barrier for attackers
• Particularly effective against organizations using weak passwords or legacy RC4-HMAC encryption

---

How the Attack Works

Attack Flow

Kerberoasting follows a systematic five-step process:

1. Enumeration: Attacker identifies service accounts with registered SPNs in the AD environment
2. TGS Request: Attacker requests a TGS ticket for the targeted service account using legitimate Kerberos authentication
3. Ticket Extraction: The domain controller responds with a ticket encrypted using the service account's password hash
4. Offline Storage: Attacker extracts and stores the encrypted ticket from memory or network traffic
5. Password Cracking: Encrypted ticket is cracked offline using brute-force or dictionary attacks to reveal the plaintext password

Technical Components

Component	Description	Common Tools
TGS Ticket	Encrypted with service account password hash (RC4-HMAC or AES)	Rubeus, Impacket, PowerView
Extraction	Retrieves encrypted tickets from Kerberos authentication process	Mimikatz, Rubeus
Cracking	Offline brute-force or dictionary attacks to decrypt tickets	Hashcat, John the Ripper
Privilege Escalation	Compromised accounts often have Domain Admin or high-level privileges	N/A

Why It's Effective: Many organizations use weak passwords for service accounts that rarely change. Additionally, RC4-HMAC encryption (still common in legacy AD environments) is significantly more vulnerable to brute-force attacks than AES-256 encryption.

---

Why Kerberoasting is Dangerous

Attack Scenarios

Lateral Movement: Cracked service account credentials enable attackers to access multiple systems and services across the network without raising suspicion.

Persistence: Service accounts provide long-term, stable access since their passwords are rarely changed and the accounts are seldom monitored for unusual activity.

Privilege Escalation: Many service accounts run with Domain Admin or other high-level privileges, giving attackers complete control over the AD environment.

Stealth: The attack generates minimal suspicious activity since it uses legitimate Kerberos requests and performs cracking offline.

Real-World Impact

• Data Breaches: Attackers exfiltrate sensitive data using compromised high-privilege accounts
• Ransomware Deployment: Elevated access facilitates rapid ransomware spread across the entire network
• Supply Chain Attacks: Compromised service accounts can access partner systems and third-party integrations
• Compliance Violations: Unauthorized access to regulated data can result in significant fines and legal consequences

---

Detection Strategies

Monitoring Techniques

Detection Method	Description	Implementation
TGS Request Monitoring	Track excessive or unusual TGS ticket requests from single accounts	Monitor Event ID 4769 for patterns
Encryption Downgrade Detection	Alert on RC4-HMAC usage when AES should be enforced	Analyze Kerberos ticket encryption types
Honeypot Accounts	Deploy decoy service accounts with weak passwords to trap attackers	Create monitored SPNs with alerting
Behavioral Analysis	Identify accounts requesting tickets for services they don't normally access	Use SIEM correlation rules

Key Event Logs to Monitor

# Event ID 4769: A Kerberos service ticket was requested
# Focus on:
# - Ticket encryption type (0x17 = RC4-HMAC is suspicious)
# - Multiple requests from same account
# - Requests for high-privilege service accounts

Detection Tip: Establish a baseline of normal TGS request patterns for your environment. Sudden spikes or requests for rarely-used service accounts are strong indicators of Kerberoasting attempts.

---

Mitigation and Defense

Immediate Actions

1. Enforce Strong Password Policies

• Require 25+ character passwords for all service accounts
• Use randomly generated passwords that include uppercase, lowercase, numbers, and special characters
• Implement password rotation schedules (every 90 days minimum)

2. Upgrade Encryption Standards

• Disable RC4-HMAC encryption across the domain
• Enforce AES-256 for all Kerberos tickets
• Audit existing service accounts for encryption type compliance

3. Implement Managed Service Accounts

• Deploy Group Managed Service Accounts (gMSAs) where possible
• gMSAs automatically rotate passwords (120 characters) every 30 days
• Eliminate human-managed service account passwords

Long-Term Hardening

Account Privilege Management

# Identify service accounts with SPNs
Get-ADUser -Filter {ServicePrincipalName -ne "$null"} -Properties ServicePrincipalName, MemberOf

# Review and minimize privileges
# Remove unnecessary group memberships
# Apply principle of least privilege

Disable RC4-HMAC Encryption

# Disable RC4 for specific service account
Set-ADUser -Identity "ServiceAccount" -KerberosEncryptionType AES256

# Domain-wide policy (Group Policy)
# Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options
# Network security: Configure encryption types allowed for Kerberos
# Enable: AES256_HMAC_SHA1, AES128_HMAC_SHA1
# Disable: RC4_HMAC_MD5

Enable Advanced Auditing

# Enable Kerberos service ticket auditing
auditpol /set /subcategory:"Kerberos Service Ticket Operations" /success:enable /failure:enable

# Enable Kerberos authentication service auditing
auditpol /set /subcategory:"Kerberos Authentication Service" /success:enable /failure:enable

Defense-in-Depth Measures

Layer	Control	Purpose
Prevention	Strong passwords + AES encryption	Make cracking computationally infeasible
Detection	SIEM alerting on Event ID 4769	Identify attacks in progress
Response	Automated account lockout for honeypots	Immediate threat containment
Recovery	Regular password rotation for service accounts	Limit window of compromise

---

Practical Implementation Guide

Step 1: Audit Current Environment

# Find all service accounts with SPNs
$serviceAccounts = Get-ADUser -Filter {ServicePrincipalName -ne "$null"} -Properties ServicePrincipalName, PasswordLastSet, msDS-SupportedEncryptionTypes

# Export for review
$serviceAccounts | Select-Object Name, ServicePrincipalName, PasswordLastSet, @{
    Name='EncryptionType'
    Expression={$_.'msDS-SupportedEncryptionTypes'}
} | Export-Csv -Path "ServiceAccountAudit.csv" -NoTypeInformation

Step 2: Implement gMSAs

# Create KDS Root Key (required for gMSA, wait 10 hours or use -EffectiveImmediately for testing)
Add-KdsRootKey -EffectiveTime ((Get-Date).AddHours(-10))

# Create a Group Managed Service Account
New-ADServiceAccount -Name "gMSA-WebService" -DNSHostName "webserver