What Is Kerberoasting?
Kerberoasting extracts service account password hashes from Active Directory for offline cracking.
How Kerberoasting Works
Kerberos authentication allows any authenticated user to request a service ticket for any service registered with a Service Principal Name in Active Directory. The service ticket is encrypted with the service account's password hash. An attacker who has initial domain access requests service tickets for all accounts with SPNs, receives encrypted tickets, and then attempts to crack the encryption offline to recover the plaintext passwords.
The offline nature of the attack is significant: the cracking occurs on attacker-controlled hardware, using GPU-accelerated password cracking tools, without generating authentication failures in the target environment. The only observable activity in Active Directory logs is service ticket requests, which occur constantly during normal operations and are difficult to distinguish from legitimate requests.
Service Account Vulnerabilities
Service accounts are disproportionately vulnerable to Kerberoasting for two reasons: they frequently have weak passwords set years ago that have never been rotated, and they frequently have excessive privileges accumulated over time. A service account with Domain Admin privileges and a password set in 2018 that has never been changed represents one of the highest-value targets in an Active Directory environment. Kerberoasting these accounts provides high-privilege credentials that enable complete domain compromise.
Defense Against Kerberoasting
The primary defenses are password length and complexity for service accounts, and managed service accounts that automatically rotate their passwords. Service accounts with passwords of 25 characters or more are computationally impractical to crack through Kerberoasting regardless of GPU resources. Microsoft Group Managed Service Accounts automatically rotate service account passwords and are the recommended approach for new service account deployments. Restricting service account privileges to the minimum necessary eliminates the value of any accounts that are successfully cracked.
Related Reading
Frequently Asked Questions
What is a Service Principal Name (SPN)?
A Service Principal Name is an identifier registered in Active Directory that maps a service to the account running it. SPNs enable Kerberos authentication for services — a client can request a service ticket for a specific SPN and receive a ticket encrypted with the service account's password hash. Common services with SPNs include SQL Server (MSSQLSvc), Microsoft Exchange, IIS web applications, and custom enterprise applications. Any account with at least one SPN registered is vulnerable to Kerberoasting.
Does Kerberoasting require admin privileges?
No. Kerberoasting requires only standard domain user privileges. Any authenticated domain user can request service tickets for any SPN-registered account. This makes Kerberoasting particularly dangerous as a privilege escalation technique — an attacker with low-privilege initial access can extract hashes for high-privilege service accounts, crack them offline, and escalate to domain administrator without exploiting any technical vulnerability.
How long does it take to crack a Kerberoasted hash?
It depends entirely on password length and complexity. Service accounts with passwords under 14 characters are typically cracked within hours using modern GPU resources. Passwords of 20-25 characters take days to weeks. Passwords of 25+ characters using random character sets become computationally impractical to crack even with substantial GPU resources. The Cloudskope assessment finding of cracking 23 service account passwords in 48 hours reflects accounts with weak passwords, not the limit of Kerberoasting effectiveness.
What is a Managed Service Account?
Microsoft Group Managed Service Accounts (gMSAs) are service accounts whose passwords are automatically generated, randomly complex, and rotated automatically by Active Directory. Because the passwords are managed by Windows and never known to humans or applications in plaintext form, gMSAs eliminate the weak-password problem that makes Kerberoasting effective. Migrating service accounts to gMSAs is the most effective single defense against Kerberoasting risk.
Can we detect Kerberoasting?
Yes, though it requires specific detection logic. Service ticket requests are normal Active Directory activity, so simple ticket request alerts produce too much noise. Effective detection focuses on patterns: a single user requesting service tickets for many different SPNs in a short timeframe, requests for tickets with weak encryption types (RC4 rather than AES), and requests from accounts that do not typically interact with the requested services. Microsoft Defender for Identity and SIEM rules tuned for Kerberoasting patterns can identify these signatures.
What is the difference between Kerberoasting and AS-REP Roasting?
Both attacks extract Kerberos credential material for offline cracking. Kerberoasting targets accounts with SPNs and uses service ticket responses. AS-REP Roasting targets accounts configured with 'Do not require Kerberos preauthentication' (a legacy setting) and uses authentication service responses. AS-REP Roasting requires only the account name (not even a valid credential) but the attack surface is much smaller because most accounts require preauthentication by default. Both attacks recover password hashes for offline cracking.
How do we audit for Kerberoasting risk?
Run a PowerShell or LDAP query against Active Directory to identify all accounts with SPNs. For each, evaluate password age and complexity. Accounts with SPNs that have weak or aged passwords represent immediate risk; accounts with SPNs and Domain Admin privileges represent critical risk regardless of password strength. Cloudskope's Active Directory security assessments include automated Kerberoasting risk evaluation with attempted offline cracking against discovered service accounts.
Real-World Example: Kerberoasting in Ransomware Campaigns
Cloudskope's Active Directory security assessments consistently find Kerberoasting vulnerabilities in client environments. In one engagement for a PE-backed manufacturing company, 23 service accounts were found vulnerable, including three with Domain Admin privileges and passwords that had not been rotated in over four years. During the assessment's penetration testing phase, all 23 passwords were cracked within 48 hours using standard GPU resources. The finding represented a complete domain compromise path from any standard user account.
Of enterprise Active Directory environments contain at least one service account vulnerable to Kerberoasting — meaning most organizations have credentials that can be extracted and cracked offline by any authenticated domain user.