Kerberoasting is an attack against Kerberos authentication in Active Directory. An attacker with any valid domain account requests service tickets for accounts that run services, then cracks those tickets offline to recover the service account’s password. It gives the attacker credentials for accounts that are often privileged, without touching the target systems.

How does Kerberos work?

Kerberos uses tickets. A user authenticates once and receives a ticket-granting ticket, which is then used to request service tickets for specific services. Each service ticket is encrypted with a key derived from the password of the account that runs the service.

How does Kerberoasting work?

1. The attacker gains a foothold with an ordinary domain account.
2. They list the accounts that have a service principal name, which identifies a service.
3. They request service tickets for those accounts. Any authenticated user is allowed to do so.
4. They extract the tickets and take them offline.
5. They try passwords until one decrypts a ticket.
6. They use the recovered password to sign in as the service account.

Why does Kerberoasting work?

Requesting a service ticket is a normal part of Kerberos, and the ticket is encrypted with a key derived from the service account’s password. Guessing happens offline, so there are no failed logins, no lockouts and no further contact with the domain.

Which accounts are most at risk?

• Service accounts with weak or old passwords.
• Service accounts that belong to privileged groups.
• Accounts whose passwords never change.
• Accounts with service principal names that nobody uses any more.

Why is Kerberoasting hard to detect?

The requests look like normal ticket requests, and the cracking never touches the network. The signs are subtle: one account requesting tickets for many services in a short time, requests that ask for weaker encryption types, tickets for services that are rarely used and later sign-ins by a service account from an unusual machine.

What is a service principal name?

A service principal name, or SPN, is the identifier that links a service to the account it runs under. Kerberos uses it to find the right account for a ticket request. Any account with an SPN can be targeted by Kerberoasting.

What is a managed service account?

Group managed service accounts let the system generate and rotate very long, random passwords automatically. Because nobody chooses the password and it changes regularly, cracking a ticket offline becomes impractical.

Does MFA stop Kerberoasting?

No. The attack happens inside Kerberos, before any interactive login, and the accounts it targets are used by services, which cannot respond to an MFA prompt. Protection comes from strong passwords, narrow privileges and monitoring.

How is it different from pass-the-hash and golden ticket attacks?

Pass-the-hash reuses a stolen password hash to authenticate. Kerberoasting recovers a password by cracking a ticket. A golden ticket attack forges tickets after the attacker has obtained the key that signs them. They are different techniques with the same aim: valid access.

What does Kerberoasting look like in practice?

An attacker with a compromised standard account lists service accounts and finds a backup account that belongs to a privileged group and has not changed its password in years. They request its ticket, crack it offline and sign in with the rights of that account.

How do you defend against Kerberoasting?

• Use long, random passwords for service accounts, or managed service accounts that rotate their passwords automatically.
• Remove service principal names that are no longer needed.
• Keep service accounts out of privileged groups.
• Prefer stronger encryption types for tickets and disable weaker ones where possible.
• Review service accounts regularly, including their age and use.

How do you detect it?

By comparing ticket requests with what is normal: unusual volumes, unusual encryption types and unusual targets. Behaviour of the service account afterwards, such as signing in from a new machine, is the other half of the signal.

Sharelock maps service accounts, their privileges and their age, so the ones that would make Kerberoasting worthwhile are found first, and it watches how they behave, so a service account that suddenly signs in from a new machine stands out.