Kerberoasting
Understand how service tickets, service accounts, and offline password auditing relate during an authorized Active Directory assessment.
Understand how service tickets, service accounts, and offline password auditing relate during an authorized Active Directory assessment.
Requirements
- A domain user context
- A service principal name mapped to an account
- Explicit authorization to test the domain
Detection
- Review unusual service-ticket request volume
- Monitor encryption types and activity involving high-value service accounts
Remediation
- Use long managed service-account secrets
- Prefer modern Kerberos encryption and minimize service-account privileges