Threat Hunting Exercise: Analyzing Windows AS-REP Roasting Against No-Pre-Auth Accounts Dataset
This hunt uses a simulated Active Directory authentication dataset (windows_asrep_roast_2022-08-03T101000.json) capturing T1558.004: AS-REP Roasting, which targets accounts with "Do not require Kerberos preauthentication" enabled to extract crackable ticket material without needing any valid credentials at all.
Step 1: Hypothesis Formation
Hypothesis: An external or unauthenticated-looking source generates AS-REQ requests for multiple domain accounts without a prior valid logon, and a subset of responses (AS-REP) are returned without requiring Kerberos pre-authentication. Indicators:
- Rapid AS-REQ requests for many distinct usernames from a single source in a short window (username enumeration/spraying pattern).
- A subset of accounts return AS-REP with encrypted timestamp data crackable offline, rather than a pre-authentication error.
- The requesting host/process is not a legitimate KDC proxy or federation service.
- No corresponding successful interactive logon for the roasted accounts around the same time.
Null Hypothesis: A legacy application or misconfigured federation service is intentionally using accounts with pre-auth disabled for compatibility, and a health-check script is enumerating them. Invalidate by cross-referencing the account list against a documented legacy-app exception list.
Rationale: AS-REP Roasting is unique among Kerberos attacks in requiring zero valid credentials to begin extracting crackable hashes, making it a critical pre-authentication blind spot; this hunt validates that pre-auth-disabled accounts are actively being targeted, not just theoretically at risk.
Step 2: Data Sources and Scope
- Sources: Domain Controller Security Event Logs (4768 - Kerberos TGT Requested, 4771 - Pre-Authentication Failed); Network taps/IDS on port 88 (Kerberos); Active Directory account attribute audit (userAccountControl DONT_REQ_PREAUTH flag).
- Scope: ~2022-08-03T10:10:00-10:14:00 UTC; Source: 10.140.9.201 (unmanaged laptop, guest VLAN); Domain: corp.local.
- SIEM Queries (Splunk/ELK):
index=wineventlog EventCode=4768 | stats dc(Account_Name) as distinct_accounts by Client_Address, bucket(_time,5m) | where distinct_accounts>15- Pre-auth-not-required success filter:
index=wineventlog EventCode=4768 Pre_Authentication_Type=0 | table _time Account_Name Client_Address - AD attribute audit:
Get-ADUser -Filter {UserAccountControl -band 4194304} -Properties userAccountControl
Step 3: Key Findings
Parsed events (6 shown) confirm a guest-VLAN host requested TGTs for 34 usernames in 4 minutes, with 3 accounts returning pre-auth-not-required AS-REP tickets suitable for offline cracking.
| Timestamp (UTC) | Source | Event | Detail | IOC/Why Suspicious? |
|---|---|---|---|---|
| 2022-08-03 10:10:03 | 10.140.9.201 (guest VLAN) | 4768 - svc-legacy1 | Pre-Auth Type=0 (none) | No-PreAuth IOC: KDC issued a TGT without requiring a valid password proof - this account can be roasted with zero credentials. |
| 2022-08-03 10:10:04 - 10:13:50 | 10.140.9.201 | 4768 (31 additional usernames) | 28 pre-auth-required errors (4771), 2 more successes | Spray IOC: 34 distinct usernames probed from one unauthenticated source in under 4 minutes - a username-enumeration sweep, not normal client behavior. |
| 2022-08-03 10:13:58 | 10.140.9.201 | 4768 - svc-print-legacy | Pre-Auth Type=0 (none) | Third roastable account identified; ticket encrypted with the account's password-derived key, crackable offline via hashcat mode 18200. |
| - | - | (AD attribute check) | 3 accounts confirmed with DONT_REQ_PREAUTH set, none on an approved legacy exception list | Confirms these are misconfigured, not intentionally excepted, accounts. |
| - | 10.140.9.201 | (asset check) | Unmanaged BYOD laptop on guest VLAN, no EDR agent | Source-anomaly IOC: legitimate service health checks do not originate from guest-network unmanaged devices. |
| - | - | (follow-up) | No interactive logons for the 3 roasted accounts followed the requests | Consistent with hash extraction for offline cracking rather than legitimate authentication. |
Validation:
- Timeline: 34-account enumeration sweep in 4 minutes from an unmanaged guest-VLAN host, yielding 3 roastable AS-REP tickets - matches known AS-REP roasting tooling (Rubeus
/asreproast, ImpacketGetNPUsers.py). - False Positives: none of the 3 flagged accounts appear on the documented legacy-application exception list; the source device has no legitimate business reason to query the KDC for 34 identities.
- Correlation: single source, tight time window, statistically implausible username breadth - high confidence reconnaissance-to-roasting activity.
Step 4: Recommendations & Next Steps
- Immediate Response: Immediately enable Kerberos pre-authentication on the 3 exposed accounts; rotate their passwords; block/quarantine 10.140.9.201 and identify the physical device owner; review guest VLAN segmentation to confirm it cannot reach domain controllers on port 88 going forward.
- Detection: Sigma-style rule:
title: AS-REP Roasting - Pre-Auth-Not-Required TGT Issuance→selection: EventID=4768 AND Pre_Authentication_Type=0 | distinct_accounts_per_source_5m > 10. - Pro Tip: Run a proactive
DONT_REQ_PREAUTHsweep across the domain quarterly - this misconfiguration is often introduced by legacy application installers and silently persists for years until an attacker finds it first.
Hypothesis confirmed - an unauthenticated guest-network host enumerated 34 accounts and successfully AS-REP roasted 3 pre-auth-disabled service accounts!