T1558.004: AS-REP Roasting
Adversaries may reveal credentials of accounts that have disabled Kerberos preauthentication by Password Cracking Kerberos messages.[1]
Preauthentication offers protection against offline Password Cracking. When enabled, a user requesting access to a resource initiates communication with the Domain Controller (DC) by sending an Authentication Server Request (AS-REQ) message with a timestamp that is encrypted with the hash of their password. If and only if the DC is able to successfully decrypt the timestamp with the hash of the user’s password, it will then send an Authentication Server Response (AS-REP) message that contains the Ticket Granting Ticket (TGT) to the user. Part of the AS-REP message is signed with the user’s password.[2]
For each account found without preauthentication, an adversary may send an AS-REQ message without the encrypted timestamp and receive an AS-REP message with TGT data which may be encrypted with an insecure algorithm such as RC4. The recovered encrypted data may be vulnerable to offline Password Cracking attacks similarly to Kerberoasting and expose plaintext credentials. [1][3]
An account registered to a domain, with or without special privileges, can be abused to list all domain accounts that have preauthentication disabled by utilizing Windows tools like PowerShell with an LDAP filter. Alternatively, the adversary may send an AS-REQ message for each user. If the DC responds without errors, the account does not require preauthentication and the AS-REP message will already contain the encrypted data. [1][3]
Cracked hashes may enable Persistence, Privilege Escalation, and Lateral Movement via access to Valid Accounts.[4]
Analyst context for executives and security teams
AS-REP Roasting matters because a single Active Directory account with Kerberos preauthentication disabled can expose password-derived material for offline cracking. For leaders, this is an identity hygiene issue: weak configuration and weak passwords can turn normal domain authentication behavior into a path toward valid account access, persistence, privilege escalation, and lateral movement.
Executive priority
Prioritize this as part of Active Directory risk reduction and audit readiness. Security leaders should ask whether any domain accounts are allowed to authenticate without Kerberos preauthentication, whether password policy strength is sufficient to withstand offline cracking, and whether domain controller auditing can prove the organization would see suspicious Kerberos ticket requests. This is especially important for privileged, service, legacy, or exception-based accounts.
Technical view
This is a Windows enterprise credential-access sub-technique under Steal or Forge Kerberos Tickets. Defenders should validate exposure by auditing accounts with preauthentication disabled and reviewing Kerberos authentication activity from domain controllers. The supplied relationship context identifies DET0113, Detect AS-REP Roasting Attempts, and Rubeus as related software. Detection engineering should focus on Kerberos TGT request evidence, LDAP discovery of accounts with preauthentication disabled, unusual request patterns across many users, and suspicious Windows/PowerShell activity where LDAP filters are used to enumerate account settings.
Likely telemetry
- Windows domain controller Kerberos authentication logs, especially TGT request events such as Microsoft event 4768
- Account configuration data showing whether Kerberos preauthentication is disabled
- LDAP query activity against Active Directory account attributes
- Windows PowerShell or command execution logs where account enumeration may occur
- Authentication failures or unusual AS-REQ/AS-REP request patterns across multiple users
Detection direction
- Validate whether DET0113-style logic is implemented and tested against local domain controller telemetry.
- Hunt for accounts with preauthentication disabled, then prioritize monitoring around those accounts.
- Review Kerberos TGT requests for unusual volume, user enumeration patterns, or requests associated with accounts that do not require preauthentication.
- Correlate Kerberos activity with LDAP enumeration and PowerShell execution where available.
- Tune carefully for administrative inventory, identity governance scans, or legitimate audit tools to reduce false positives.
Mitigation priorities
- Remove unnecessary exceptions by enabling Kerberos preauthentication on domain accounts wherever operationally possible.
- Apply strong password policies consistent with M1027, especially for accounts that cannot immediately be remediated.
- Audit account configuration and authentication logs regularly, consistent with M1047, and retain evidence for compliance and incident response.
- Review Kerberos encryption posture and reduce reliance on insecure algorithms where supported by the environment.
- Prioritize privileged, service, and legacy accounts for remediation because cracked credentials may enable valid-account access and follow-on movement.
Analyst notes and limits
The business value is in confirming both exposure and observability: which accounts are roastable, whether passwords are resilient, and whether the SOC can identify suspicious Kerberos requests from domain controller logs. Relationship context links this behavior to the broader Kerberos ticket abuse technique T1558 and to Rubeus as related Windows software.
MITRE did not provide an official detection section for this object. Recommendations are derived from the official description, external references, and supplied relationships. Local Active Directory design, legacy application requirements, audit policy, and log retention determine actual risk and detection feasibility.
AS-REP Roasting
Adversaries may reveal credentials of accounts that have disabled Kerberos preauthentication by Password Cracking Kerberos messages.[1]
Preauthentication offers protection against offline Password Cracking. When enabled, a user requesting access to a resource initiates communication with the Domain Controller (DC) by sending an Authentication Server Request (AS-REQ) message with a timestamp that is encrypted with the hash of their password. If and only if the DC is able to successfully decrypt the timestamp with the hash of the user’s password, it will then send an Authentication Server Response (AS-REP) message that contains the Ticket Granting Ticket (TGT) to the user. Part of the AS-REP message is signed with the user’s password.[2]
For each account found without preauthentication, an adversary may send an AS-REQ message without the encrypted timestamp and receive an AS-REP message with TGT data which may be encrypted with an insecure algorithm such as RC4. The recovered encrypted data may be vulnerable to offline Password Cracking attacks similarly to Kerberoasting and expose plaintext credentials. [1][3]
An account registered to a domain, with or without special privileges, can be abused to list all domain accounts that have preauthentication disabled by utilizing Windows tools like PowerShell with an LDAP filter. Alternatively, the adversary may send an AS-REQ message for each user. If the DC responds without errors, the account does not require preauthentication and the AS-REP message will already contain the encrypted data. [1][3]
Cracked hashes may enable Persistence, Privilege Escalation, and Lateral Movement via access to Valid Accounts.[4]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Related techniques
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1558 | Steal or Forge Kerberos Tickets | This object subtechnique of Steal or Forge Kerberos Tickets. |
Groups, software, and campaigns
All related ATT&CK context
Mitigation direction
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.2 | Current bundle | 2dde40c36160… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
Harmj0y Roasting AS-REPs Jan 2017
HarmJ0y. (2017, January 17). Roasting AS-REPs. Retrieved September 23, 2024.
Open source URL -
[2]
Microsoft Kerberos Preauth 2014
Sanyal, M.. (2014, March 18). Kerberos Pre-Authentication: Why It Should Not Be Disabled. Retrieved August 25, 2020.
Open source URL -
[3]
Stealthbits Cracking AS-REP Roasting Jun 2019
Jeff Warren. (2019, June 27). Cracking Active Directory Passwords with AS-REP Roasting. Retrieved August 24, 2020.
Open source URL -
[4]
SANS Attacking Kerberos Nov 2014
Medin, T. (2014, November). Attacking Kerberos - Kicking the Guard Dog of Hades. Retrieved March 22, 2018.
Open source URL -
[5]
AdSecurity Cracking Kerberos Dec 2015
Metcalf, S. (2015, December 31). Cracking Kerberos TGS Tickets Using Kerberoast – Exploiting Kerberos to Compromise the Active Directory Domain. Retrieved March 22, 2018.
Open source URL -
[6]
Microsoft 4768 TGT 2017
Microsoft. (2017, April 19). 4768(S, F): A Kerberos authentication ticket (TGT) was requested. Retrieved August 24, 2020.
Open source URL -
[7]
Microsoft Detecting Kerberoasting Feb 2018
Bani, M. (2018, February 23). Detecting Kerberoasting activity using Azure Security Center. Retrieved March 23, 2018.
Open source URL -
[8]
mitre-attack T1558.004Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.