Kerberoasting Activity

Kerberos is an authentication protocol that creates tickets encrypted with account keys to verify identity and permissions. A ticket contains user, computer, or service account credentials that are encrypted with a cipher algorithm. Kerberoasting is a post-exploitation attack technique where an attacker requests service tickets for accounts with weak passwords and a Service Principal Name (SPN). The service ticket contains ciphertext of service account credentials. After acquiring the service tickets, the attacker performs offline cracking of ciphertext to steal the credentials.

An attacker with network access to the DC can leverage attack tools to automate Kerberoasting. For example, the attacker runs a script to create a malicious Kerberos ticket-granting service request (TGS_REQ) and requests a service ticket from the Key Distribution Center (KDC) in a DC. The malicious request includes encryption types (etype). The etype influences which encryption algorithm the DC selects to encrypt the service ticket. The malicious Kerberos request typically specifies an etype for a weak algorithm, such as RC4. The attacker collects multiple service tickets from TGS responses (TGS_RSP). Service tickets that are encrypted with RC4 are easier to crack offline with brute force techniques.