What is it?
Kerberoasting abuses legitimate Kerberos behavior. A domain user can request a ticket for an account with a service principal name. Part of that ticket is encrypted with key material derived from the service-account password and can be tested offline.
How it works in plain English
Use this three-part model to understand the attack without memorizing a tool name.
The system accepts a credential, token, ticket, recovery decision, or identity assertion as proof of who the requester is.
The attacker obtains, guesses, forges, replays, or changes that authentication material.
Focus on how the identity was acquired, where it was used, what device and network context changed, and what happened immediately after success.
Worked example: how the sequence may look
A valid domain account or TGT.
Request service tickets for selected SPNs.
Domain controller Event ID 4769.
Baseline 4769 volume, SPNs, client hosts, and encryption types.
If successful, the attacker may continue with Password Cracking. This is a possibility, not a guaranteed next step.
This is a defensive learning scenario. Real incidents vary, and the listed outcome is only one possible path.
Why do attackers use it?
Recover service-account passwords without repeated service logins.
Avoid account lockouts during offline guessing.
Target old, static, or privileged service-account passwords.
Escalate privilege or move laterally.
Prerequisites
A valid domain account or TGT.
Discoverable service principal names.
Connectivity to a domain controller.
Offline cracking resources and a weak enough password.
Attack path possibilities
Attack chains are not fixed. These links show common possibilities to investigate before and after this behavior.
A small set of common passwords is tried across many accounts to avoid per-user lockout thresholds.
T1566.002 Spearphishing LinkA targeted message links to credential theft or malware delivery.
T1078.001 Default Account AbuseBuilt-in or vendor-default accounts are used for unauthorized access.
T1078.004 Cloud Account TakeoverStolen credentials, tokens, or recovery paths control a cloud identity.
Stolen password hashes are tested offline against candidate passwords.
T1550.003 Pass-the-TicketA stolen Kerberos ticket is reused to access resources without the account password.
T1003.006 DCSyncDirectory replication rights are abused to request domain password data.
T1021 Remote ServicesRDP, SMB, SSH, WinRM, VNC, or similar services are used to access remote systems.
Step-by-step attack flow
Authenticate to the domain.
Enumerate accounts with service principal names.
Request service tickets for selected SPNs.
Extract encrypted ticket material.
Test password candidates offline.
Use recovered service credentials according to their privileges.
MITRE ATT&CK mapping
ATT&CK is updated over time. Verify the live technique before operationalizing a detection.
Logs and artifacts
Domain controller Event ID 4769.
RC4 ticket encryption type 0x17 where AES is expected.
One user requesting many distinct service tickets rapidly.
Requests for high-value SPNs from unusual workstations.
Realistic log examples
These records use realistic field names and formats but synthetic organizations, users, addresses, and identifiers. A single event is not proof; correlate time, identity, source, target, and the resulting action.
Kerberos service-ticket request; useful for roasting, ticket abuse, and unusual service access.
2026-07-16T14:25:10Z EventID=4769 Computer=DC01.corp.example
TargetUserName=analyst@CORP.EXAMPLE ServiceName=MSSQLSvc/sql01.corp.example:1433
IpAddress=10.24.18.77 IpPort=53110 TicketEncryptionType=0x17
TicketOptions=0x40810000 Status=0x0 TransmittedServices=-Baseline 4769 volume, SPNs, client hosts, and encryption types.
Cloud sign-in context including identity, application, source, result, device, and conditional access.
2026-07-16T14:24:51Z UserPrincipalName=j.singh@corp.example
AppDisplayName="Office 365 Exchange Online" IPAddress=203.0.113.48
ResultType=50126 ResultDescription="Invalid username or password"
ClientAppUsed=Browser ConditionalAccessStatus=notApplied
DeviceDetail.operatingSystem=Windows Location=SGAlert on bursts of tickets from one account or endpoint.
Failed authentication; useful for guessing, spraying, exposed remote services, and account targeting.
2026-07-16T14:22:31Z EventID=4625 Computer=DC01.corp.example
TargetUserName=j.singh TargetDomainName=CORP LogonType=3
AuthenticationPackageName=NTLM WorkstationName=WKSTN-442
IpAddress=203.0.113.48 IpPort=51842
Status=0xC000006D SubStatus=0xC000006A FailureReason="Unknown user name or bad password"Prioritize RC4 and privileged service accounts.
- Who or what identity acted?
- From which device, process, IP, or workload?
- What target and operation were involved?
- Did it fail, succeed, or change state?
- What correlated event happened immediately before and after?
Detection logic / SIEM queries
Baseline 4769 volume, SPNs, client hosts, and encryption types.
Alert on bursts of tickets from one account or endpoint.
Prioritize RC4 and privileged service accounts.
Correlate requests with directory enumeration and suspicious processes.
SecurityEvent
| where EventID == 4769
| summarize Requests=count(), Services=dcount(ServiceName),
ServiceList=make_set(ServiceName, 30),
RC4=countif(TicketEncryptionType == "0x17")
by Account, IpAddress, bin(TimeGenerated, 15m)
| where Services >= 10 or RC4 >= 5index=wineventlog EventCode=4769 Ticket_Encryption_Type=0x17
| bucket _time span=15m
| stats count dc(Service_Name) as services values(Service_Name) as spns
by _time Account_Name Client_Address
| where count>=5 OR services>=5Mitigations
Use managed service accounts or long random vaulted passwords.
Enable AES and remove RC4 dependencies.
Minimize service-account privilege and deny interactive logon.
Remove stale SPNs and service accounts.
Monitor 4769 and high-value services continuously.
Real-world examples
Operation Wocao used PowerSploit to request tickets and crack service passwords.
Empire includes Kerberoasting functionality through PowerSploit.
It is common in both penetration tests and real AD intrusions.
Common questions
01Does requesting a ticket require admin rights?
No. A normal authenticated domain user can generally request tickets for published SPNs.
02Why do long random passwords help?
The ticket can still be requested, but offline guessing becomes impractical.