ReddRadar
Agent skill
performing-kerberoasting-attack
Kerberoasting is a post-exploitation technique that targets service accounts in Active Directory by requesting Kerberos TGS (Ticket Granting Service) tickets for accounts with Service Principal Names
Install this agent skill to your Project
npx add-skill https://github.com/autohandai/community-skills/tree/main/performing-kerberoasting-attack
SKILL.md
Performing Kerberoasting Attack
Overview
Kerberoasting is a post-exploitation technique that targets service accounts in Active Directory by requesting Kerberos TGS (Ticket Granting Service) tickets for accounts with Service Principal Names (SPNs) set. These tickets are encrypted with the service account's NTLM hash, allowing offline brute-force cracking without generating failed login events. It is one of the most common privilege escalation paths in AD environments because any domain user can request TGS tickets.
MITRE ATT&CK Mapping
- T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting
- T1087.002 - Account Discovery: Domain Account
- T1069.002 - Permission Groups Discovery: Domain Groups
Implementation Steps
Phase 1: SPN Enumeration
- Enumerate accounts with SPNs using LDAP queries
- Filter for user accounts (not computer accounts)
- Identify accounts with elevated privileges (adminCount=1)
- Prioritize accounts with weak password policies
Phase 2: TGS Ticket Request
- Request TGS tickets for identified SPN accounts
- Extract ticket data in crackable format (hashcat/john compatible)
- Ensure RC4 encryption is requested when possible (easier to crack)
- Document all requested tickets
Phase 3: Offline Cracking
- Use hashcat mode 13100 (Kerberos 5 TGS-REP etype 23) for RC4 tickets
- Use hashcat mode 19700 (Kerberos 5 TGS-REP etype 17) for AES-128
- Use hashcat mode 19800 (Kerberos 5 TGS-REP etype 18) for AES-256
- Apply targeted wordlists and rules based on password policy
Phase 4: Credential Validation
- Validate cracked credentials against domain
- Assess access level of compromised accounts
- Map accounts to BloodHound attack paths
- Document for engagement report
Tools and Resources
| Tool | Purpose | Platform |
|---|---|---|
| Rubeus | Kerberoasting and ticket manipulation | Windows (.NET) |
| Impacket GetUserSPNs.py | Remote Kerberoasting | Linux/Python |
| PowerView | SPN enumeration | Windows (PowerShell) |
| hashcat | Offline password cracking | Cross-platform |
| John the Ripper | Offline password cracking | Cross-platform |
Detection Indicators
- Event ID 4769: Kerberos Service Ticket Request with RC4 encryption (0x17)
- Anomalous TGS requests from a single account in short timeframe
- TGS requests for services the user normally does not access
- Honeypot SPN accounts with alerting on ticket requests
Validation Criteria
- SPN accounts enumerated and documented
- TGS tickets extracted in crackable format
- Offline cracking attempted with appropriate wordlists
- Cracked credentials validated
- Access level of compromised accounts assessed
Recommended Agent Skills
Expand your agent's capabilities with these related and highly-rated skills.
autohandai/community-skills
mapping-mitre-attack-techniques
Maps observed adversary behaviors, security alerts, and detection rules to MITRE ATT&CK techniques and sub-techniques to quantify detection coverage and guide control prioritization. Use when building an ATT&CK-based coverage heatmap, tagging SIEM alerts with technique IDs, aligning security controls to adversary playbooks, or reporting threat exposure to executives. Activates for requests involving ATT&CK Navigator, Sigma rules, MITRE D3FEND, or coverage gap analysis.
autohandai/community-skills
hunting-for-spearphishing-indicators
Hunt for spearphishing campaign indicators across email logs, endpoint telemetry, and network data to detect targeted email attacks.
autohandai/community-skills
analyzing-malicious-url-with-urlscan
URLScan.io is a free service for scanning and analyzing suspicious URLs. It captures screenshots, DOM content, HTTP transactions, JavaScript behavior, and network connections of web pages in an isolat
autohandai/community-skills
implementing-zero-standing-privilege-with-cyberark
Deploy CyberArk Secure Cloud Access to eliminate standing privileges in hybrid and multi-cloud environments using just-in-time access with time, entitlement, and approval controls.
autohandai/community-skills
implementing-pam-for-database-access
Deploy privileged access management for database systems including Oracle, SQL Server, PostgreSQL, and MySQL. Covers session proxy configuration, credential vaulting, query auditing, dynamic credentia
autohandai/community-skills
detecting-t1003-credential-dumping-with-edr
Detect OS credential dumping techniques targeting LSASS memory, SAM database, NTDS.dit, and cached credentials using EDR telemetry, Sysmon process access monitoring, and Windows security event correlation.
Didn't find tool you were looking for?