As the cornerstone of enterprise IT ecosystems for identity and access management, Active Directory (AD) continues to serve as its pillar of support. It has been trusted to handle centralised authentication and authorisation processes for decades, enabling organisations to manage users, devices, applications, and services across a complex networked environment.
The AD platform has long been in use and has played a critical role in the enterprise, yet its architecture and accumulated technical debt have made it a popular target for cyber adversaries, despite its widespread use and critical role. Threat actors have used various attack vectors to achieve their objectives, but Kerberoasting is one of the most commonly observed and effective techniques they employ.
Kerberoasting is a sophisticated post-exploitation technique which allows cyber attackers to extract and crack service account credentials from Active Directory environments.
There are specific vulnerabilities in this vulnerability in the Kerberos authentication protocol. Kerberos is a trusted protocol that was created for the purpose of facilitating secure identity verification across potentially untrusted networks, such as the Internet.
Kerberoasting is a play on words, which emphasises the way adversaries basically roast Kerberos service tickets in order to expose sensitive data.
An attacker who has already gained access to the network through the compromise of a low-privileged account, or who has been granted access through Kerberoasting, uses legitimate Kerberos functionality to take advantage of it.
If an attacker requests service tickets associated with specific service principal names, the Key Distribution Center (KDC) will send them back in a format encrypted with the password hash of the service account in an encrypted format.
When these tickets are exported, they can then be subjected to offline brute force or dictionary attacks, which will not trigger immediate alarms in the environment if the password for the service account is weak or guessable, allowing attackers to retrieve the credentials in clear text and use them to move laterally, escalate privileges, or exfiltrate sensitive information.
Insidious as Kerberoasting is, it's stealthiness and efficiency that make it so dangerous—it does not require elevated privileges for execution, and it can be carried out using either built-in tools or widely available open-source tools. Even if an attacker manages to limit their reach by hardening account privileges and enforcing strict access controls, one poorly configured or insecure account is all it takes to complete a full domain compromise.
Thus, in order to combat such attacks, it is important to implement proactive detections, robust credential hygiene, and robust security monitoring as essential components. Kerberoasting exploits inherent vulnerabilities in the Kerberos authentication protocol, specifically in the way in which service principal names (SPNs) are managed within Active Directory.
When attackers exploit these mechanisms, they can be able to extract encrypted service tickets from memory, attempt offline brute-force attacks against these tickets, and eventually retrieve the plaintext credentials for service accounts that were previously encrypted.
In the absence of proper mitigation, this method often results in lateral movement, privilege escalation, and the full compromise of the domain.
It is becoming increasingly difficult for organisations to identify, prevent, and remediate such threats as attackers are continuing to refine their tools and techniques.
Users must understand the technical aspects of Kerberoasting and implement targeted defences if they want to ensure the integrity of their Active Directory environment.
A Kerberoasting attack is particularly effective when a combination of insecure configurations, weak passwords for service accounts, and outdated encryption algorithms such as RC4 remain common in legacy Active Directory environments, which have a tendency to be particularly vulnerable.
In order to carry out these attacks successfully, it is necessary to take advantage of Kerberos functionality in a manner that remains difficult to detect with traditional security monitoring tools because these attacks utilise standard Kerberos functionality.
If an actor manages to get hold of a valid domain user account, regardless of its privilege level, they will be able to start orchestrating the attack using the tools readily available to them and the built-in commands built into their system.
In order to perform Kerberos-based authentication, it is necessary to identify Active Directory accounts associated with Service Principal Names (SPNs). These SPNs indicate which accounts are attached to specific services within the network.
A common method of exploiting the SPNs of accounts is by enumerating them with reconnaissance tools such as GetUserSPNs.py, which was developed by SecureAuth Corporation, or Rubeus, which was developed by GhostPack.
After identifying these service accounts, the attacker requests a Kerberos Key Distribution Centre (KDC) ticket for one or more of these service accounts.
It is the KDC's responsibility to generate a TGS ticket that is encrypted using the hash of the password of the target service account. This ticket is then harvested and taken offline by the attacker since the password is encrypted.
Since the encryption relies on the password hash, an attacker can use an offline brute force attack or dictionary attack to recover the plaintext password, using tools such as Hashcat or John the Ripper.
Because the attackers are operating offline during this stage, they can work undetected and at their own pace while the attacker works undetected.
Once the service account's password is cracked successfully, the attacker has a legitimate set of credentials to authenticate as that account. In turn, this enables unauthorised access to any services or systems tied to the compromised account, which allows for unauthorised access.
It is important to note, however, that depending on the permissions and scope associated with the service account, the attacker may be able to escalate privileges, exfiltrate sensitive data, manipulate systems, or set up persistence mechanisms that can be exploited in the future.
The attack path highlights the importance of ensuring robust password policies are implemented, service account privileges are limited, and legacy cryptographic protocols are eliminated in order to minimise the risk of Kerberoasting and other credential-based attacks.
It is important for organisations to develop a dynamic and layered defence strategy in order to reduce the attack surface and enhance the overall resilience of their Active Directory (AD) environments as Kerberoasting tactics continue to evolve.
It is important to have technical controls in place, architecture awareness, and ongoing testing of security practices to mitigate the threat posed by such attacks.
A method that can be very effective is integrating the understanding of Kerberos authentication mechanisms with hardening of service account configurations and deploying advanced detection capabilities.
For proactive security measures to be effective, strong password policies must be enforced for all service accounts, especially those that are associated with Service Provider Networks.
Keeping passwords complicated, lengthy, and rotating regularly will decrease the probability of offline cracking attempts, and in addition, minimising the privileges assigned to service accounts—ensuring they operate by the principle of least privilege—can considerably reduce the impact of a compromised credential.
Detecting Kerberoasting activity is equally important as having visibility and situational awareness.
Due to the fact that the attack relies on Kerberos functionality, conventional detection methods may not be effective. Consequently, organisations should use robust monitoring systems capable of identifying anomalous Kerberos ticket request patterns or excessive Kerberos SPN enumeration behaviour that may indicate an ongoing attack.
Security Information and Event Management (SIEM) systems, enhanced with behavioural analytics, play a crucial role to play in highlighting any anomalies that may indicate an ongoing attack.
It is important for organisations to perform regular automated penetration testing and red teaming exercises to further strengthen their defensive capabilities by simulating real-world attacks and validating the effectiveness of the security controls.
These assessments allow organisations to stay on top of emerging technologies and develop more effective incident response strategies.
Kerberos security is ultimately determined by the organization's ability to maintain visibility into its environment, enforce strict account hygiene, and adjust its defenses to respond to evolving threats in order to maintain visibility into the environment.
In order to be able to build a resilient AD infrastructure against Kerberoasting and other credential-based attacks, organisations need to combine preventative measures with continuous monitoring and testing.
Defending Active Directory environments from Kerberoasting and similar credential-based threats in the future requires organisations to shift from reactive defences to a proactive, security-by-design approach to effectively protect themselves.
The task is much greater than applying patchwork fixes, as it also involves reevaluating how service accounts are managed, monitored, and secured over the course of their lifecycle as a whole.
In reality, every service account, particularly one with elevated privileges or access to critical systems, should be treated as a high-value asset and be overseen by strict provisioning and auditing processes through automated auditing tools as well as periodic re-evaluations of credentials.
A transition away from legacy authentication mechanisms and the adoption of modern alternatives, including Group Managed Service Accounts (gMSAs), tiered access models, and Just-in-Time (JIT), will significantly reduce exposure without negatively affecting operational performance. As well as continuously educating oneself and one's organisation on the shifting tactics of adversaries, security teams should also continuously educate themselves and their organisations on how adversaries are changing tactics.
There is an increasing trend of threat actors adopting advanced tools and stealthier methods. Complacency is becoming a silent enabler of compromise, resulting in increased threats. By establishing blue team readiness, threat hunting capabilities, and cross-functional security awareness, people will be able to strengthen their technical defences and also foster a culture of resilience in their organisations.
There is more to it than just defending against a particular attack - Kerberoasting is an indication of the overall maturity of a company when it comes to security. The organisations that prioritise layered security architecture, continuous validation, and intelligent automation will be better prepared to withstand today's threats and those that will emerge in the future.
