Rep roasting is an Active Directory attack that targets service accounts and other identities with Service Principal Names by requesting Kerberos tickets without prior authentication. Attackers can then crack the encrypted ticket offline to recover the account password, often gaining access to systems or privileged services tied to that NHI.
How rep roasting works
Rep roasting is a Kerberos abuse technique aimed at accounts that have Service Principal Names. The attacker asks the Key Distribution Center for a ticket without first proving knowledge of the account password, then captures the encrypted ticket and works on it offline.
That offline step matters because the attacker can try many guesses without generating repeated authentication failures on the target account. If the password is weak or reused, one successful crack can expose a service account that is trusted by multiple systems.
Why rep roasting is dangerous
Rep roasting turns ordinary service-account exposure into credential recovery. The danger is not the ticket itself, but the fact that the ticket can reveal a password that may unlock privileged services, scheduled tasks, application back ends, or lateral movement paths tied to the account.
Because the attack happens after the ticket is issued, defenders may see only normal Kerberos traffic unless they are looking for unusual ticket requests, weak encryption, or service accounts that should never be broadly reachable. A Kerberos Security Guide is useful here because rep roasting sits alongside kerberoasting, AS-REP roasting, ticket abuse, and post-compromise detection in the same protocol family.
How organisations reduce exposure
The first control is inventory: know which accounts have SPNs, where they are used, and whether they are still needed. Many rep roasting opportunities exist because legacy service accounts persist long after the application or integration that created them has changed.
Reduce the value of captured tickets by using strong, random, non-shared passwords for service accounts and by removing old or unnecessary SPNs. Organisations should also limit where those accounts can log on and review whether any service can move to a managed identity model, a gMSA, or another account type with tighter lifecycle control.
Hardening guidance from NIST SP 800-53 Rev 5 Security and Privacy Controls helps frame the broader control set, especially around access control, identification and authentication, auditing, and account lifecycle management.
Detection and recovery after suspected abuse
Detection usually focuses on identifying suspicious Kerberos ticket requests and on spotting service accounts that are unusually attractive targets, such as accounts with high privilege or weak ticket encryption. Monitoring should extend beyond the initial request to later signs that the cracked password was used elsewhere.
After suspected exploitation, review the account for lateral movement, privileged access, and unexpected service logons. If cracking is plausible, rotate the password, inspect dependent services, and confirm that the account does not preserve access through cached credentials, scheduled tasks, or other persistence paths.
Adversary technique mapping in MITRE ATT&CK Enterprise Matrix is helpful for connecting ticket abuse to credential access, privilege escalation, and lateral movement behaviours that often follow a successful crack.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1558 — Steal or Forge Kerberos Tickets | Rep roasting is a Kerberos ticket abuse technique in the credential access family. |
| Recommendation — Map ticket abuse to T1558 and hunt for Kerberos requests that precede offline cracking. | ||
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | Service accounts and SPN-bearing identities require lifecycle control and review. |
| IA-5 — Authenticator Management | Rep roasting succeeds when service-account password material is weak or poorly managed. | |
| AU-2 — Event Logging | Kerberos ticket requests and related account activity need audit coverage to detect abuse. | |
| Recommendation — Inventory SPN-bearing accounts and remove or disable service identities that are no longer needed. Enforce strong authenticator lifecycle practices for service accounts and rotate credentials after compromise. Log and review Kerberos-related events for unusual ticket requests and follow-on account use. | ||