T1558.003: Kerberoasting
Adversaries may abuse a valid Kerberos ticket-granting ticket (TGT) or sniff network traffic to obtain a ticket-granting service (TGS) ticket that may be vulnerable to Brute Force.[1][2]
Service principal names (SPNs) are used to uniquely identify each instance of a Windows service. To enable authentication, Kerberos requires that SPNs be associated with at least one service logon account (an account specifically tasked with running a service[3]).[4][5][6][7]
Adversaries possessing a valid Kerberos ticket-granting ticket (TGT) may request one or more Kerberos ticket-granting service (TGS) service tickets for any SPN from a domain controller (DC).[1][2] Portions of these tickets may be encrypted with the RC4 algorithm, meaning the Kerberos 5 TGS-REP etype 23 hash of the service account associated with the SPN is used as the private key and is thus vulnerable to offline Brute Force attacks that may expose plaintext credentials.[2][1] [7]
This same behavior could be executed using service tickets captured from network traffic.[2]
Cracked hashes may enable Persistence, Privilege Escalation, and Lateral Movement via access to Valid Accounts.[6]
Analyst context for executives and security teams
Kerberoasting matters because it turns normal Windows Kerberos service-ticket behavior into a credential-access path against Active Directory service accounts. If a service account password is weak enough to crack offline, the resulting valid account can support persistence, privilege escalation, and lateral movement, making this a high-value control-validation topic for Windows domain resilience.
Executive priority
Prioritize this where Windows domains depend on service principal names and long-lived service accounts. Leadership should ask whether service accounts are least-privileged, governed by strong password policy, monitored when Kerberos service tickets are requested, and included in incident-response credential rotation plans. This is also useful audit evidence: it connects privileged account management, password policy, encryption choices, and domain-controller logging to a concrete credential-access risk.
Technical view
ATT&CK lists Kerberoasting as a Windows credential-access sub-technique under Steal or Forge Kerberos Tickets. The behavior involves a valid TGT or captured network traffic being used to obtain TGS service tickets for SPNs; portions of those tickets may use RC4, exposing Kerberos 5 TGS-REP etype 23 material to offline brute force. SOC and IR teams should validate visibility at domain controllers, SPN/service-account inventory quality, and whether alerts can distinguish expected service-ticket activity from unusual requests against many SPNs or sensitive service accounts. ATT&CK provides no official detection text, but relates DET0157, Detect Kerberoasting Attempts, to this object.
Likely telemetry
- Domain controller Kerberos authentication and TGS request logs
- Service principal name inventory and the associated service logon accounts
- Service account privilege, role, and password policy records
- Network telemetry where Kerberos service tickets may be observed or captured
- Endpoint and script/process telemetry on Windows systems where Kerberos-focused tools may run
Detection direction
- Confirm domain controllers generate and retain Kerberos service-ticket request evidence sufficient to identify requests for SPNs and RC4/TGS-REP etype 23 patterns where available.
- Baseline normal service-ticket request volume by user, host, service account, and SPN so detection logic can focus on unusual breadth, frequency, or access to sensitive service accounts.
- Tune carefully for administrators, scanners, applications, and legitimate service discovery that may request many tickets and create false positives.
- Use relationship context for validation: ATT&CK links Kerberoasting to public tools/frameworks including PowerSploit, Impacket, Empire, SILENTTRINITY, Brute Ratel C4, and Rubeus, so endpoint/script telemetry may add corroboration but should not be the only detection path.
- Treat gaps in DC logging, SPN ownership data, and service-account privilege mapping as material blind spots because the cracking activity can occur offline after ticket material is obtained.
Mitigation priorities
- Start with privileged account management: reduce service-account privileges, assign clear ownership, monitor use, and ensure accountability through logging and auditing.
- Enforce strong password policies for service accounts, with length and complexity appropriate to resist offline brute force and with controls against reuse.
- Review SPNs and remove or correct unnecessary, stale, or over-privileged service account associations.
- Prefer strong encryption choices for sensitive authentication material where supported by the environment, consistent with the ATT&CK mitigation relationship to Encrypt Sensitive Information.
- Include suspected Kerberoasting in IR playbooks: identify requested SPNs, assess exposed service accounts, rotate affected credentials, and review subsequent valid-account activity for persistence, privilege escalation, or lateral movement.
Analyst notes and limits
This object supersedes revoked technique T1208 and is a sub-technique of T1558, Steal or Forge Kerberos Tickets. ATT&CK relationships show use by multiple campaigns/groups and availability in several public or commercial toolsets, which supports prioritizing defensive validation without implying current activity in any specific environment.
The supplied ATT&CK object has no official detection procedure, so detection guidance is derived from the technique description and relationship context. Local Windows domain configuration, Kerberos logging, encryption settings, SPN hygiene, and service-account privilege data are required to determine actual exposure and coverage.
Kerberoasting
Adversaries may abuse a valid Kerberos ticket-granting ticket (TGT) or sniff network traffic to obtain a ticket-granting service (TGS) ticket that may be vulnerable to Brute Force.[1][2]
Service principal names (SPNs) are used to uniquely identify each instance of a Windows service. To enable authentication, Kerberos requires that SPNs be associated with at least one service logon account (an account specifically tasked with running a service[3]).[4][5][6][7]
Adversaries possessing a valid Kerberos ticket-granting ticket (TGT) may request one or more Kerberos ticket-granting service (TGS) service tickets for any SPN from a domain controller (DC).[1][2] Portions of these tickets may be encrypted with the RC4 algorithm, meaning the Kerberos 5 TGS-REP etype 23 hash of the service account associated with the SPN is used as the private key and is thus vulnerable to offline Brute Force attacks that may expose plaintext credentials.[2][1] [7]
This same behavior could be executed using service tickets captured from network traffic.[2]
Cracked hashes may enable Persistence, Privilege Escalation, and Lateral Movement via access to Valid Accounts.[6]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Related techniques
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1208 | Kerberoasting | Kerberoasting revoked by this object. |
| Enterprise | T1558 | Steal or Forge Kerberos Tickets | This object subtechnique of Steal or Forge Kerberos Tickets. |
Groups, software, and campaigns
G0102: Wizard Spider
Wizard Spider is a Russia-based financially motivated threat group originally known for the creation and deployment of TrickBot since at least 2016. Wizard Spider possesses a diverse arsenal of tools and has conducted ransomware campaigns against a variety of organizations, ranging from major corporations to hospitals.[1][2][3]
G0046: FIN7
FIN7 is a financially-motivated threat group that has been active since 2013. FIN7 has targeted the retail, restaurant, hospitality, software, consulting, financial services, medical equipment, cloud services, media, food and beverage, transportation, pharmaceutical, and utilities industries in the United States. A portion of FIN7 was operated out of a front company called Combi Security and often used point-of-sale malware for targeting efforts. Since 2020, FIN7 shifted operations to big game hunting (BGH), including use of REvil ransomware and their own Ransomware-as-a-Service (RaaS), Darkside. FIN7 may be linked to the Carbanak Group, but multiple threat groups have been observed using Carbanak, leading these groups to be tracked separately.[1][2][3][4][5][6][7]
G0119: Indrik Spider
Indrik Spider is a Russia-based cybercriminal group that has been active since at least 2014. Indrik Spider initially started with the Dridex banking Trojan, and then by 2017 they began running ransomware operations using BitPaymer, WastedLocker, and Hades ransomware. Following U.S. sanctions and an indictment in 2019, Indrik Spider changed their tactics and diversified their toolset.[1][2][3]
S1071: Rubeus
S0357: Impacket
S0363: Empire
Empire is an open-source, cross-platform remote administration and post-exploitation framework that is publicly available on GitHub. While the tool itself is primarily written in Python, the post-exploitation agents are written in pure PowerShell for Windows and Python for Linux/macOS. Empire was one of five tools singled out by a joint report on public hacking tools being widely used by adversaries.[1][2][3]
S0692: SILENTTRINITY
SILENTTRINITY is an open source remote administration and post-exploitation framework primarily written in Python that includes stagers written in Powershell, C, and Boo. SILENTTRINITY was used in a 2019 campaign against Croatian government agencies by unidentified cyber actors.[1][2]
S0194: PowerSploit
PowerSploit is an open source, offensive security framework comprised of PowerShell modules and scripts that perform a wide range of tasks related to penetration testing such as code execution, persistence, bypassing anti-virus, recon, and exfiltration. [1] [2] [3]
S1063: Brute Ratel C4
Brute Ratel C4 is a commercial red-teaming and adversarial attack simulation tool that first appeared in December 2020. Brute Ratel C4 was specifically designed to avoid detection by endpoint detection and response (EDR) and antivirus (AV) capabilities, and deploys agents called badgers to enable arbitrary command execution for lateral movement, privilege escalation, and persistence. In September 2022, a cracked version of Brute Ratel C4 was leaked in the cybercriminal underground, leading to its use by threat actors.[1][2][3][4][5]
C0049: Leviathan Australian Intrusions
Leviathan Australian Intrusions consisted of at least two long-term intrusions against victims in Australia by Leviathan, relying on similar tradecraft such as external service exploitation followed by extensive credential capture and re-use to enable privilege escalation and lateral movement. Leviathan Australian Intrusions were focused on exfiltrating sensitive data including valid credentials for the victim organizations.[1]
C0014: Operation Wocao
Operation Wocao was a cyber espionage campaign that targeted organizations around the world, including in Brazil, China, France, Germany, Italy, Mexico, Portugal, Spain, the United Kingdom, and the United States. The suspected China-based actors compromised government organizations and managed service providers, as well as aviation, construction, energy, finance, health care, insurance, offshore engineering, software development, and transportation companies.[1]
Security researchers assessed the Operation Wocao actors used similar TTPs and tools as APT20, suggesting a possible overlap. Operation Wocao was named after an observed command line entry by one of the threat actors, possibly out of frustration from losing webshell access.[1]
C0024: SolarWinds Compromise
The SolarWinds Compromise was a sophisticated supply chain cyber operation conducted by APT29 that was discovered in mid-December 2020. APT29 used customized malware to inject malicious code into the SolarWinds Orion software build process that was later distributed through a normal software update; they also used password spraying, token theft, API abuse, spear phishing, and other supply chain attacks to compromise user accounts and leverage their associated access. Victims of this campaign included government, consulting, technology, telecom, and other organizations in North America, Europe, Asia, and the Middle East. This activity has been labled the StellarParticle campaign in industry reporting.[1] Industry reporting also initially referred to the actors involved in this campaign as UNC2452, NOBELIUM, Dark Halo, and SolarStorm.[2][3][4][5][1][6][7][8]
In April 2021, the US and UK governments attributed the SolarWinds Compromise to Russia's Foreign Intelligence Service (SVR); public statements included citations to APT29, Cozy Bear, and The Dukes.[9][10][11] The US government assessed that of the approximately 18,000 affected public and private sector customers of Solar Winds’ Orion product, a much smaller number were compromised by follow-on APT29 activity on their systems.[12]
All related ATT&CK context
Mitigation direction
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.3 | Current bundle | abb020124226… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
Empire InvokeKerberoast Oct 2016
EmpireProject. (2016, October 31). Invoke-Kerberoast.ps1. Retrieved March 22, 2018.
Open source URL -
[2]
AdSecurity Cracking Kerberos Dec 2015
Metcalf, S. (2015, December 31). Cracking Kerberos TGS Tickets Using Kerberoast – Exploiting Kerberos to Compromise the Active Directory Domain. Retrieved March 22, 2018.
Open source URL -
[3]
Microsoft Detecting Kerberoasting Feb 2018
Bani, M. (2018, February 23). Detecting Kerberoasting activity using Azure Security Center. Retrieved March 23, 2018.
Open source URL -
[4]
Microsoft SPN
Microsoft. (n.d.). Service Principal Names. Retrieved March 22, 2018.
Open source URL -
[5]
Microsoft SetSPN
Microsoft. (2010, April 13). Service Principal Names (SPNs) SetSPN Syntax (Setspn.exe). Retrieved March 22, 2018.
Open source URL -
[6]
SANS Attacking Kerberos Nov 2014
Medin, T. (2014, November). Attacking Kerberos - Kicking the Guard Dog of Hades. Retrieved March 22, 2018.
Open source URL -
[7]
Harmj0y Kerberoast Nov 2016
Schroeder, W. (2016, November 1). Kerberoasting Without Mimikatz. Retrieved September 23, 2024.
Open source URL -
[8]
mitre-attack T1558.003Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.