Targeted Kerberoasting is an Active Directory attack that requests service tickets for chosen service accounts and then tries to crack them offline to recover service account passwords. Attackers use it to gain privileged access through weak or reused passwords. Defenders should monitor unusual service ticket requests, use long random service account passwords, and reduce excessive SPN exposure.
How Targeted Kerberoasting Works
Targeted kerberoasting is a deliberate Active Directory attack path, not a broad spray-and-pray technique. The attacker first identifies service accounts with service principal names, then requests tickets for those accounts so the ticket material can be attacked offline.
Because the attack is offline after ticket collection, defenders may not see an obvious authentication failure pattern during the cracking phase. That is why the real danger sits in the combination of account selection, ticket exposure, and weak service account passwords.
Why It Is Dangerous
The technique is dangerous because service accounts often have elevated reach, long-lived credentials, and broader access than ordinary user accounts. If the password is weak or reused, a single cracked ticket can unlock access to systems, data, or administrative functions that the service account already trusts.
Targeting matters as much as cracking. An attacker who chooses only high-value accounts can focus effort on the identities most likely to deliver lateral movement, privilege escalation, or durable access once recovered.
For background on the wider Kerberos attack surface, see NHIMG’s Kerberos Security Guide.
How Organisations Reduce Exposure
Exposure review starts with service account inventory. Teams need to know which accounts have SPNs, which of them are interactive or overprivileged, and which are exposed to the same password hygiene problems that attackers exploit.
Mitigation is strongest when service account passwords are long, random, unique, and rotated under controlled processes. Reducing unnecessary SPN exposure also lowers the number of accounts that can be selected for ticket requests in the first place.
The most useful control work is usually operational rather than exotic: discover service accounts, remove avoidable privilege, and treat password policy for these accounts as a separate governance problem from ordinary user authentication.
NHIMG’s Service Account Security Guide explains the lifecycle and governance issues that make these accounts attractive targets.
Detection, Response, and Recovery
Detection should focus on unusual ticket-request behaviour, especially requests that do not match the normal access pattern for a service account or application. Correlating ticket activity with identity context, host context, and time-of-day anomalies makes it easier to spot targeted collection before offline cracking succeeds.
If compromise is suspected, review the service account for misuse, password exposure, and any downstream systems it can reach. Recovery often means more than changing a password, because the account may already have been used to access services, scheduled tasks, or integrated applications.
After an incident, organisations should assume the attacker may have learned more than one secret path. A focused post-incident review is needed to understand whether the service account was used for lateral movement, persistence, or follow-on access.
NHIMG’s Identity Threat Detection and Response (ITDR) Guide is a useful reference for identity-focused detection and response patterns.
Risk and Threat Considerations
Targeted Kerberoasting creates a concentrated risk when a single service account combines weak password hygiene with meaningful privilege. The attack is especially dangerous because the collection step may look routine while the actual compromise happens offline, outside normal control points.
Failure mechanism: The attacker identifies a service account with an SPN, requests a service ticket, extracts ticket material, and tries to recover the password offline until access can be reused against trusted systems.
Impact: Successful cracking can expose privileged service access, enable lateral movement, and turn one overexposed account into a durable foothold across multiple systems.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1558.003 — Kerberoasting | Targeted Kerberoasting is a Kerberos credential access technique. |
| Recommendation — Map Kerberoasting activity to T1558.003 and hunt for suspicious service-ticket requests. | ||
| CIS Controls v8 | CIS-5 — Account Management | Service accounts and SPN exposure are account-governance problems that drive this attack. |
| Recommendation — Inventory service accounts and remove unnecessary privilege and exposure. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Long-lived service account passwords and rotation are central to reducing offline cracking risk. |
| AC-6 — Least Privilege | Excessive service-account privilege is what makes a cracked ticket so damaging. | |
| AU-6 — Audit Record Review, Analysis, and Reporting | Unusual ticket requests and identity anomalies need audit review to detect targeted Kerberoasting. | |
| Recommendation — Enforce controlled credential rotation and strong authenticator lifecycle management for service accounts. Reduce service-account permissions to the minimum needed for the application. Review Kerberos-related audit data for anomalous service-ticket request patterns. | ||
Practitioner Guidance
Why practitioners should care: Treat service accounts as high-value identities, not housekeeping accounts. The attack works best where ownership is unclear, passwords are long-lived, and SPNs are exposed more widely than necessary.
What to watch for: Focus on accounts that have elevated permissions, broad application reach, or older operational patterns that make password rotation and monitoring difficult. Those are the accounts most likely to turn a ticket request into an access incident.
Practitioner takeaway: The most effective defence is usually to make service accounts harder to target and less rewarding if targeted, rather than relying on ticket-request monitoring alone.