A Kerberoasting attack targets Kerberos authentication to steal service account credentials for later misuse. An attacker requests service tickets for accounts with service principal names, cracks the encrypted ticket offline to recover the password, then uses that access to move laterally or escalate privileges inside the domain.
What Kerberoasting Means in Practice
Kerberoasting is dangerous because it turns ordinary Kerberos service-ticket requests into an offline password attack against accounts that often have elevated reach. The attacker does not need to break the protocol itself, only to obtain material they can crack outside the domain.
That matters because service accounts are frequently long-lived, broadly trusted, and harder to manage than user accounts. When those credentials are recovered, the attacker can often blend in as a legitimate principal rather than rely on noisy exploitation.
Why Service Accounts Are the Real Target
The attack focuses on service accounts that have registered service principal names, since those accounts can be requested for tickets and then tested offline. In many environments, the risk is not the ticket alone but the account design around it, especially weak passwords, stale ownership, and excessive privilege.
Service account hardening belongs on the same footing as privilege reduction. NHIMG’s Service Account Security Guide is useful here because it connects Kerberoasting to discovery, least privilege, managed identities, rotation, and governance across common enterprise platforms.
Kerberos-specific defence also matters because the attacker is abusing a legitimate authentication flow. NHIMG’s Kerberos Security Guide covers the protocol mechanics, the ticketing behaviour that Kerberoasting relies on, and related detections and hardening steps.
How the Attack Progresses After Initial Access
Kerberoasting is usually a post-compromise technique, not a first-entry technique. Once an attacker can query tickets, they can work offline until they recover a password that unlocks broader internal access, then use that identity for lateral movement, delegation abuse, or privilege escalation.
That is why the technique sits inside the wider family of identity attacks. NHIMG’s Top 10 Identity Attacks places Kerberoasting alongside token theft, password spraying, and other identity-based paths that turn valid credentials into persistence.
Detection is also important because Kerberoasting often looks like normal ticket activity until the volume, timing, or target pattern becomes suspicious. NHIMG’s Identity Threat Detection and Response (ITDR) Guide helps frame the telemetry and response logic needed when authentication events become part of an attack chain.
What Good Defence Looks Like
Good defence starts with knowing which service accounts exist, which systems depend on them, and which of them still use risky password practices or unnecessary privileges. The most useful controls are the ones that reduce offline cracking value, limit the blast radius of compromise, and make abnormal ticket behaviour visible.
In practice, that means treating service-account governance as an ongoing control problem rather than a one-time cleanup. Rotation, managed identities where possible, restricted permissions, and monitoring for unusual ticket requests all matter because they reduce the chance that a single cracked account becomes a domain-wide foothold.
Risk and Threat Considerations
Kerberoasting creates a high-value path from routine authentication traffic to credential compromise because the attacker can crack tickets offline without repeatedly touching the domain controller. The result is often stealthier than direct password attacks and more dangerous when the targeted account has broad application, server, or administrative reach.
Failure mechanism: Weak or long-lived service-account passwords, unnecessary SPNs, and excessive privilege give the attacker material that can be cracked and reused for legitimate-looking access.
Impact: A successful crack can expose service access, enable lateral movement, and turn one compromised account into a durable foothold for escalation or persistence.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1558.003 — Kerberoasting | Directly models the service-ticket cracking technique used against Kerberos. |
| Recommendation — Map ticket-request and offline-cracking activity to T1558.003 and hunt for service-account abuse. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Service-account credential lifecycle and rotation are central to reducing cracking value. |
| IA-2 — Identification and Authentication (Organizational Users) | Kerberoasting abuses authenticated enterprise identities and their trust relationships. | |
| AC-6 — Least Privilege | The impact depends on how much access the cracked service account can exercise. | |
| Recommendation — Enforce IA-5 to rotate and manage service credentials that Kerberoasting targets. Use IA-2 to strengthen authentication policy and reduce weak identity exposure. Apply AC-6 to minimize the permissions available to any compromised service account. | ||
Practitioner Guidance
Why practitioners should care: Kerberoasting is often missed because it abuses expected Kerberos behaviour, so defenders must look beyond perimeter and endpoint signals to identity telemetry and service-account hygiene.
What to watch for: Prioritise accounts with service principal names, weak password history, excessive group membership, and abnormal ticket-request patterns, especially where the account can reach many hosts or applications.
Practitioner takeaway: The safest service account is one that is unnecessary, tightly scoped, rotated or replaced, and continuously monitored for abuse rather than assumed to be benign.