ASREPRoast

How ASREPRoast Works

ASREPRoast targets Kerberos user accounts that do not require pre-authentication. In that configuration, an attacker can ask the domain controller for an AS-REP response and receive material that is encrypted with the user’s key, which creates an offline cracking opportunity without needing to keep interacting with the target.

Why the Technique Is Dangerous

The main danger is that the attacker can work offline after the initial request, so network defenses have less visibility into the password-cracking phase. If the account uses a weak or guessable password, the captured response can become a path to credential recovery and, from there, broader domain access.

This is also a trust failure in Kerberos setup, not a flaw in the protocol itself: disabling pre-authentication removes an important proof step that normally limits unauthorised request handling. The issue becomes more serious when the exposed account is privileged, reused, or poorly monitored.

How Organisations Check Exposure

Exposure checks should begin with an inventory of domain accounts that have pre-authentication disabled, especially where those accounts are older, service-like, or no longer actively owned. Because the attack depends on account configuration rather than a software bug, the fastest way to find exposure is to review directory settings, account purpose, and whether the setting is still needed.

Security teams should also look at where Kerberos traffic can be observed, whether the account can be reached from untrusted networks, and whether the domain controller logs or directory audit data can show repeated AS-REQ activity. NIST SP 800-53 Rev 5 Security and Privacy Controls is useful here because account auditing, authentication controls, and log review are all part of validating whether the environment is exposed.

For defenders, the practical question is not only “is the account roastable?” but also “would a cracked password create real business impact?” That means checking whether the account has privileged group membership, access to sensitive applications, or reuse across systems.

Remediation and Monitoring After Exposure

The most direct fix is to re-enable pre-authentication wherever the account does not have a strong, documented exception. If an exception must remain temporarily, treat the account as a high-value target and reduce its blast radius through tighter access, stronger password policy, and closer monitoring.

Detection should focus on unusual requests for AS-REP material, repeated authentication attempts against the same account, and follow-on activity that suggests a cracked password has been used to authenticate elsewhere. Post-incident review should include password resets for any account suspected of exposure, plus rotation of dependent secrets or keys where the account may have been used to access other systems. MITRE ATT&CK Enterprise Matrix helps map the attack path from credential access through later movement, while NIST SP 800-63 Digital Identity Guidelines reinforces the value of stronger authenticators and reduced reliance on easily guessed passwords.

Risk and Threat Considerations

ASREPRoast is dangerous because it converts a directory configuration weakness into an offline password-cracking problem. That changes the defender’s position: the attacker only needs a single successful request, after which the cracking effort can move outside normal monitoring and rate limiting.

Failure mechanism: disabling Kerberos pre-authentication allows an unauthenticated requester to obtain encrypted AS-REP material that can be attacked offline until the password is recovered.

Impact: credential recovery can lead to account takeover, privilege escalation if the account is over-privileged, and additional lateral movement if the password is reused or the account has broad access.

Practitioner Guidance

What to watch for: treat disabled pre-authentication as an exception that needs ownership, expiry, and explicit business justification. In practice, the safest posture is to assume any such account will be targeted and to remove the condition unless there is a strong operational reason to keep it.

Governance implication: ASREPRoast is often less about a single exploit and more about directory hygiene, password strength, and account lifecycle discipline. The accounts that matter most are the ones that no one has revisited in a long time.