Kerberoasting is an attack on Windows Active Directory in which an attacker who already has a valid domain login asks for service tickets and then tries to crack them offline to learn a service account password. MITRE ATT&CK tracks it as technique T1558.003. Weak, rarely changed service account passwords make it easier.
- Related Terms3linked entriesActive Directory · Privilege escalation · Credential theft
- Read Next1guide on the same topicThreat Intelligence 101
How does Kerberoasting work?
Kerberos is the sign-in system used in Active Directory. Services are identified by a service principal name. MITRE ATT&CK says adversaries with a valid Kerberos ticket-granting ticket can request service tickets for these names, and that portions of the tickets may be encrypted with the RC4 algorithm. That makes them vulnerable to offline brute force attacks.
The key point is that the guessing happens on the attacker’s own machine. Because the guessing is offline, it does not create failed sign-ins on your network. If the password is weak, the attacker gets the service account password in clear text.
Why does it matter?
Service accounts often have wide access and passwords that nobody changes. A cracked one can help an attacker move from a single ordinary account to far more powerful access. The attacker needs a valid domain account first, so Kerberoasting usually comes after an earlier step such as phishing or stolen credentials. A leaked staff login can be that first step.
How do you defend against it?
MITRE lists these mitigations:
- Use a long, complex password for service accounts. MITRE says ideally 25 or more characters.
- Enable AES Kerberos encryption instead of RC4.
- Give service accounts only the access they need.
How can it be detected?
MITRE suggests watching for Windows event 4769 (a service ticket request) that uses RC4 encryption, and for an unusual number of service ticket requests from one account.
Where does Brandefense fit?
Kerberoasting starts after an attacker holds a valid login. Brandefense Cyber Threat Intelligence and Dark Web Monitoring help you see when staff credentials are exposed, so they can be reset before they become that first step.
Related pages in the Knowledge Hub
Questions.
-
What is Kerberoasting?
It is an attack in which someone with a valid domain login requests Kerberos service tickets and cracks them offline to recover a service account password. MITRE ATT&CK tracks it as T1558.003.
-
Does Kerberoasting need admin rights?
MITRE describes the adversary using a valid Kerberos ticket-granting ticket, which any valid domain account can hold. It does not need to start as an administrator.
-
How do you reduce the risk of Kerberoasting?
MITRE advises long service account passwords (ideally 25 or more characters), AES Kerberos encryption instead of RC4, and minimal privileges for service accounts.
Sources
In Our Research
- 1 Akira ransomware advisory AA24-109A: stages and tools October 2026
- 2 Top 5 Ransomware Groups in Q2 2026: Who They Are, How They Operate, and What They Target July 2026
- 3 APT40 threat group profile Threat group
- 4 FIN7 Threat group
- 5 Indrik Spider Threat group
- 6 Wizard Spider Threat group