Kerberoasting

In Active Directory, any authenticated user can ask a domain controller for a service ticket to any service that has a Service Principal Name (SPN), which is how services such as SQL Server or web applications are registered. Part of that ticket is encrypted with the service account's password hash.

Kerberoasting abuses this. The attacker, using any ordinary domain account, requests tickets for interesting service accounts, takes them offline and tries to crack them with password lists. Nothing unusual happens on the network beyond a few ticket requests, and the cracking leaves no logs at all. Service accounts are attractive targets because they often have old, human-chosen passwords that never expire and more privileges than they need.

Example

After phishing one employee, an attacker runs a tool that lists every account with an SPN and requests a ticket for each. One of them belongs to a backup service account whose password, set eight years ago, is the company name followed by a year. It cracks in minutes, and the account turns out to be a member of Domain Admins.

Why it matters for a SOC analyst

On domain controllers, watch event 4769 (service ticket requested) for a single account requesting tickets for many different services in a short time, and especially for tickets using the older RC4 encryption type (0x17). The fix is on the defensive side: long random passwords or group managed service accounts (gMSA), AES-only encryption and service accounts with only the privileges they need.