What Is Kerberoasting Attack?

A Kerberoasting attack is a post-exploitation technique where attackers exploit the Kerberos authentication mechanism to extract encrypted service account credentials from an Active Directory environment.

In this attack, a malicious user requests service tickets associated with service accounts. These tickets are encrypted using the service account’s password hash. The attacker then captures these tickets and attempts to crack them offline to reveal the original passwords.

What makes Kerberoasting particularly dangerous is that it uses legitimate system functionality. Any authenticated user can request service tickets, which means the attack can be executed without raising immediate suspicion.

How Kerberoasting Works

Kerberoasting leverages the normal process of Kerberos-based authentication to retrieve encrypted service tickets.

Key Steps in the Attack

• Identify accounts with Service Principal Names (SPNs)  
• Request Ticket Granting Service (TGS) tickets for those accounts  
• Extract the encrypted ticket data  
• Perform offline password cracking using tools or wordlists  
• Use recovered credentials to access services or escalate privileges  

Because password cracking happens outside the network, traditional monitoring tools often fail to detect this activity.

Why Kerberoasting Is Dangerous

Kerberoasting is highly effective because it targets service accounts, which often have elevated privileges and weak password policies.

Unlike brute-force login attacks, Kerberoasting avoids triggering account lockouts or detection systems. The attacker works silently, extracting and cracking credentials without interacting further with the target system.

Additionally, service account passwords are rarely rotated, increasing the likelihood of successful compromise.

Common Indicators of Kerberoasting

Although the attack is stealthy, certain behaviors can signal potential Kerberoasting activity.

Indicators to Watch

• High volume of TGS ticket requests  
• Requests targeting multiple service accounts  
• Activity from non-admin users querying SPNs  
• Use of credential extraction tools or suspicious scripts  
• Unusual authentication patterns across systems  

Monitoring these signals can help detect early stages of the attack.

How to Prevent Kerberoasting Attacks

Defending against Kerberoasting requires strengthening identity and access management practices.

Best Practices

• Use strong, complex passwords for all service accounts  
• Implement Group Managed Service Accounts (gMSA)  
• Rotate service account credentials regularly  
• Apply the principle of least privilege  
• Monitor Kerberos activity and ticket requests  
• Enable logging and anomaly detection  

A combination of strong password hygiene and monitoring significantly reduces risk.

Summary

Kerberoasting attacks exploit the Kerberos protocol to extract and crack service account credentials without triggering traditional security alerts.

Because the attack requires only basic user access and operates using legitimate system processes, it is both stealthy and effective. Organizations must focus on securing service accounts, monitoring authentication behavior, and enforcing strong identity controls to defend against this threat.

FAQ

Q1. What is Kerberoasting?

Kerberoasting is an attack where hackers steal encrypted service tickets and crack them to reveal service account passwords.

Q2. Does Kerberoasting require admin access?

No, any authenticated domain user can perform a Kerberoasting attack.

Q3. What is the goal of a Kerberoasting attack?

The goal is to obtain service account credentials and use them to access systems or escalate privileges.

Q4. Why are service accounts targeted?

Service accounts often have elevated privileges and weak or rarely changed passwords.

Q5. How can Kerberoasting be prevented?

It can be prevented using strong passwords, credential rotation, monitoring, and managed service accounts.