performing-kerberoasting-attack

name	performing-kerberoasting-attack
description	Kerberoasting is a post-exploitation technique that targets service accounts in Active Directory by requesting Kerberos TGS (Ticket Granting Service) tickets for accounts with Service Principal Names. Use when working with performing kerberoasting attack.
domain	cybersecurity
subdomain	red-teaming
tags	["red-team","adversary-simulation","mitre-attack","exploitation","post-exploitation","kerberoasting","active-directory","credential-access"]
version	1.0
author	oyi77
license	Apache-2.0
d3fend_techniques	["Application Protocol Command Analysis","Network Isolation","Network Traffic Analysis","Client-server Payload Profiling","Network Traffic Community Deviation"]
nist_csf	["ID.RA-01","GV.OV-02","DE.AE-07"]

Performing Kerberoasting Attack

Legal Notice: This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.

Overview

Kerberoasting is a post-exploitation technique that targets service accounts in Active Directory by requesting Kerberos TGS (Ticket Granting Service) tickets for accounts with Service Principal Names (SPNs) set. These tickets are encrypted with the service account's NTLM hash, allowing offline brute-force cracking without generating failed login events. It is one of the most common privilege escalation paths in AD environments because any domain user can request TGS tickets.

When to Use

Trigger phrases:

• "performing kerberoasting attack"

• "Kerberoasting is a post-exploitation technique that targets service accounts in "

• When conducting security assessments that involve performing kerberoasting attack

• When following incident response procedures for related security events

• When performing scheduled security testing or auditing activities

• When validating security controls through hands-on testing

Prerequisites

• Familiarity with red teaming concepts and tools
• Access to a test or lab environment for safe execution
• Python 3.8+ with required dependencies installed
• Appropriate authorization for any testing activities

MITRE ATT&CK Mapping

• T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting
• T1087.002 - Account Discovery: Domain Account
• T1069.002 - Permission Groups Discovery: Domain Groups

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs() -> :
     {k: re.findall(v, text)  k, v  IOC_PATTERNS.items()}