What is Kerberoasting, and how do organisations defend against it?

Any authenticated user can request a service ticket for any service; because the ticket is encrypted with the service account's key, which is derived from that account's password, the attacker can crack it offline; long random service passwords (or managed service accounts) and strong encryption types defeat it.

The attack uses the protocol exactly as designed:

1. The attacker, logged in as any ordinary domain user, asks the TGS for service tickets for services that run under user accounts (accounts with a service principal name, such as MSSQLSvc/db01).
2. The TGS issues them; it does not check whether the user is allowed to use the service, because authorisation is the service's job.
3. The attacker takes the tickets offline and guesses passwords until one decrypts the ticket. A service account with the password Summer2024! falls within minutes.

Defences:

• Long, random passwords for service accounts, ideally (group) managed service accounts, whose long random passwords Windows generates and rotates automatically.
• AES only, disabling the old RC4 encryption type, which is much faster to crack.
• Monitoring for one user suddenly requesting many service tickets.

Go deeper:

• MITRE ATT&CK: Kerberoasting (T1558.003) — the attack, tools and recommended mitigations.
• Compass Security: Kerberos deep-dive video series — six episodes from protocol basics to Kerberoasting, AS-REP roasting and delegation.