Kerberoasting: Cracking Service Accounts From a Normal User

Kerberoasting (SPN roasting) lets any authenticated domain user recover service-account passwords without elevated privileges. In Active Directory, a user can request a service ticket (TGS) for any account with a registered Service Principal Name (SPN). Part of the returned ticket is encrypted with a key derived from that service account’s password, so the attacker extracts the ticket and cracks it offline — no further interaction with the domain controller and no admin rights required. Attackers deliberately request RC4-encrypted (etype 23) tickets because RC4 cracks far faster than AES. MITRE ATT&CK tracks it as T1558.003.

How It Works

A normal TGS-REQ returns a ticket whose service portion is encrypted with the service account’s long-term key. The attacker captures these tickets for SPN-bearing accounts and runs an offline dictionary or brute-force attack against them. The “RC4 downgrade” — requesting the weaker RC4 encryption type — is a hallmark. The technique is effective because many service accounts have weak, non-rotated, over-privileged passwords. T1558.003

Tooling

Rubeus, Impacket’s GetUserSPNs.py, the Mimikatz Kerberos module and Invoke-Kerberoast request the tickets; Hashcat and John the Ripper crack them offline. The Five Eyes “Detecting and Mitigating Active Directory Compromises” guide (2024) names Kerberoasting as a top AD technique.

MITRE ATT&CK Mapping

Detection & Mitigation

• Monitor Kerberos TGS requests (Event ID 4769), especially those specifying RC4 (ticket encryption type 0x17), and baseline per-account and per-host request volume.
• Use group Managed Service Accounts (gMSAs) or long (25+ character) random passwords for SPN accounts, and rotate them.
• Disable RC4 and enforce AES for Kerberos where supported; remove unnecessary SPNs from privileged and user accounts and apply least privilege.
• Consider honeypot SPN accounts that should never be legitimately requested as a high-fidelity tripwire.