Log in Request a demo

Glossary

Kerberoasting.

Learn more
Threat Intelligence 101
Product track
Cyber Threat Intelligence
In Short

Kerberoasting is an attack on Windows Active Directory in which an attacker who already has a valid domain login asks for service tickets and then tries to crack them offline to learn a service account password. MITRE ATT&CK tracks it as technique T1558.003. Weak, rarely changed service account passwords make it easier.

Last updated October 23, 2026
Profile MapGlossary Term
  1. Related Terms3linked entriesActive Directory · Privilege escalation · Credential theft
  2. Read Next1guide on the same topicThreat Intelligence 101

How Does Kerberoasting Work?

Kerberos is the sign-in system used in Active Directory. Each service is identified by a service principal name (SPN), and an SPN is tied to a service account. MITRE ATT&CK says an adversary holding a valid ticket-granting ticket can ask a domain controller for service tickets for any SPN.

MITRE adds that portions of these tickets may be encrypted with the RC4 algorithm. The password hash of the service account is then the key, so the ticket is open to offline brute force. The same attack works on tickets captured from network traffic.

The guessing happens on the attacker’s own machine. Your domain controllers never see the wrong guesses, so there are no failed sign-ins to count. If the password is weak, the attacker learns it in clear text.

Kerberos is also used to sign dynamic DNS updates through GSS-TSIG. In October 2026 ISC fixed a memory corruption flaw in that feature, explained in our post on the BIND 9 GSS-TSIG vulnerability.

What Can a Cracked Service Account Unlock?

MITRE says cracked hashes may enable persistence, privilege escalation and lateral movement through valid accounts. One cracked password can turn a single stolen login into several kinds of access.

The attacker needs a valid ticket-granting ticket first, so Kerberoasting comes after an earlier step that gave a domain login. A leaked staff login can be that step.

Five Checks for Service Accounts

MITRE lists the mitigations and the detection analytic for Kerberoasting. The steps below turn them into work for this week.

Five Checks for Service Accounts
  1. List accounts with an SPNFind user accounts that have an SPN set. Their tickets are what an attacker asks for.
  2. Lengthen the passwordsUse 25 or more characters with expiry. MITRE also names group managed service accounts and password vaults.
  3. Move to AESEnable AES Kerberos encryption instead of RC4 where possible, so tickets are harder to crack.
  4. Trim their rightsGive each service account minimal privileges, and keep it out of groups such as Domain Admins.
  5. Alert on event 4769Flag RC4 requests (etype 0x17), one account asking for many tickets, or a service account used oddly.

Where Does Brandefense Fit?

Kerberoasting starts after an attacker holds a valid login. Brandefense Cyber Threat Intelligence and Dark Web Monitoring help you see when staff credentials are exposed, so they can be reset before they become that first step.

Questions.

  • What is Kerberoasting?

    It is an attack in which someone with a valid domain login requests Kerberos service tickets and cracks them offline to recover a service account password. MITRE ATT&CK tracks it as T1558.003.

  • Does Kerberoasting need admin rights?

    MITRE describes the adversary using a valid Kerberos ticket-granting ticket, which any valid domain account can hold. It does not need to start as an administrator.

  • How do you reduce the risk of Kerberoasting?

    MITRE advises long service account passwords (ideally 25 or more characters), AES Kerberos encryption instead of RC4, and minimal privileges for service accounts.

Sources

  1. 1 Steal or Forge Kerberos Tickets: Kerberoasting (T1558.003), MITRE ATT&CK
  2. 2 Steal or Forge Kerberos Tickets (T1558), MITRE ATT&CK

In Our Research

  1. 1 Aur0ra Ransomware’s AI Agent Intrusions: A Defender’s Task List November 2026
  2. 2 Akira ransomware advisory AA24-109A: stages and tools October 2026
  3. 3 Top 5 Ransomware Groups in Q2 2026: Who They Are, How They Operate, and What They Target July 2026
  4. 4 APT40 threat group profile Threat group
  5. 5 FIN7 Threat group
  6. 6 Indrik Spider Threat group

Keep Learning.

101 guide Threat Intelligence 101 A plain introduction to threat intelligence: what it is, how it works and how a small team can start using it. Open

Keep Exploring.

Knowledge Hub
Threat group APT40 Threat Group Profile APT40 (tracked by MITRE as Leviathan) is attributed by the US and UK governments (2021) and by agencies in eight countries (2024) to China's Ministry of State Security. The US charged four people in 2021, three of them named as officers of its Hainan State Security Department. Open Threat group FIN7 Attributed by the US Department of Justice to a financially motivated criminal conspiracy of dozens of computer specialists, FIN7 is described in US court papers as stealing tens of millions of payment card records from US businesses, and the FBI has warned about its mailed USB devices used to deliver ransomware. It hacks company networks to steal card data and, in later years, to deploy ransomware. Open Glossary term Brute Force Attack A brute force attack is a method of guessing passwords or other secret values by trying many combinations until one works. Open Glossary term MITRE ATT&CK MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations. Open

Browse The Library.