T1558.003Credential Access

Kerberoasting

Kerberoasting lets any domain user request a crackable ticket for a service account, then brute-force its password offline. Here is exactly what it looks like in your logs and the Sigma and Wazuh rules that catch it.

Run it live: Kerberoast to Domain Admin

A real Active Directory domain with a kerberoastable service account, an attacker box, and a Wazuh SIEM. Request the ticket, crack it offline, then find event 4769 in the SIEM.

Launch it

Kerberoasting abuses a normal feature of Kerberos: any authenticated domain user can request a service ticket (TGS) for any account that has a Service Principal Name (SPN). Part of that ticket is encrypted with the service account's password hash, so an attacker requests the ticket, takes it offline, and brute-forces the password at their leisure, with no further contact with the domain. Service accounts often have weak, non-expiring passwords and excessive privilege, which is why this one technique so often ends in Domain Admin.

What it looks like

On the attacker side it is a single request. With Impacket that is `GetUserSPNs.py -request`, or in Rubeus `kerberoast`. The tell is the ticket's encryption type: attackers force RC4 (etype 0x17) because it cracks far faster than AES. On the domain controller, every ticket request writes a Kerberos Service Ticket Operations event, Event ID 4769, and the roasting request stands out as RC4 to a user-associated SPN from a normal workstation.

Windows Security log, DC: Event ID 4769 with Ticket Encryption Type 0x17 (RC4).
A burst of 4769s for many different service names from one account is bulk roasting.
The Service Name is a user account SPN (e.g. svc_sql), not a machine account ($).
Ticket Options often 0x40810000; Failure Code 0x0.

Detect it: Sigma

sigma / kerberoasting-rc4-tgs.yml

title: Kerberoasting via RC4 Service Ticket Request
id: 0f1a2b3c-roast-4d5e-6f70-tyrian000001
status: stable
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4769
    TicketEncryptionType: '0x17'   # RC4-HMAC, forced by roasting tools
    TicketOptions: '0x40810000'
  filter_machine:
    ServiceName|endswith: '$'       # exclude computer-account SPNs
  filter_krbtgt:
    ServiceName: 'krbtgt'
  condition: selection and not filter_machine and not filter_krbtgt
level: high
tags:
  - attack.credential_access
  - attack.t1558.003

The rule keys on the two things a roasting tool controls: an RC4-encrypted TGS for a user SPN. Excluding machine accounts (`$`) and krbtgt removes the normal Kerberos noise. In a healthy modern domain, RC4 TGS requests for service accounts should be rare, so even a low volume is worth an alert.

Detect it: Wazuh

wazuh / local_rules.xml

<group name="windows,kerberos,attack,">
  <rule id="100410" level="10">
    <if_group>windows_security</if_group>
    <field name="win.system.eventID">^4769$</field>
    <field name="win.eventdata.ticketEncryptionType">^0x17$</field>
    <description>Kerberoasting: RC4 service ticket requested (T1558.003)</description>
    <mitre>
      <id>T1558.003</id>
    </mitre>
    <options>no_full_log</options>
  </rule>

  <!-- Raise severity when one account roasts many SPNs in a short window -->
  <rule id="100411" level="12" frequency="8" timeframe="120">
    <if_matched_sid>100410</if_matched_sid>
    <same_field>win.eventdata.targetUserName</same_field>
    <description>Kerberoasting: bulk RC4 ticket requests from one account</description>
    <mitre>
      <id>T1558.003</id>
    </mitre>
  </rule>
</group>

Reduce the attack surface

Give service accounts long (25+ char) random passwords, or use Group Managed Service Accounts (gMSA).
Disable RC4 where you can so tickets are AES-only, which makes offline cracking impractical.
Audit which accounts have SPNs and remove ones that don't need them.
Alert on 4769 RC4 for user SPNs, then measure your mean-time-to-detect against a real request.

Tyrian runs this end to end. The Kerberoast to Domain Admin scenario builds a real domain with a kerberoastable svc_sql account, an attacker box with Impacket, and a Wazuh SIEM. You request the ticket, crack it, and watch 4769 land in the SIEM, then measure how long detection took.

Test this detection on your own SIEM

Launch the Kerberoast to Domain Admin range, fire T1558.003, and measure how fast you catch it. $5 free credit, no card.

Start free More techniques