Techniques › T1558 › T1558.003
T1558.003 Kerberoasting
credential access — Windows · attack.mitre.org · JSON
1
MITRE detection strategy
1
analytics
18
Sigma rules tagged attack.t1558.003
0
KEV CVEs mapped here
<p>Adversaries may abuse a valid Kerberos ticket-granting ticket (TGT) or sniff network traffic to obtain a ticket-granting service (TGS) ticket that may be vulnerable to Brute Force.</p><p>Service principal names (SPNs) are used to uniquely identify each instance of a Windows service. To enable authentication, Kerberos requires that SPNs be associated with at least one service logon account (an account specifically tasked with running a service).</p><p>Adversaries possessing a valid Kerberos ticket-granting ticket (TGT) may request one or more Kerberos ticket-granting service (TGS) service tickets for any SPN from a domain controller (DC). Portions of these tickets may be encrypted with the RC4 algorithm, meaning the Kerberos 5 TGS-REP etype 23 hash of the service account associated with the SPN is used as the private key and is thus vulnerable to offline Brute Force attacks that may expose plaintext credentials.</p><p>This same behavior could be executed using service tickets captured from network traffic.</p><p>Cracked hashes may enable Persistence, Privilege Escalation, and Lateral Movement via access to Valid Accounts.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0157 Detect Kerberoasting Attempts (T1558.003) v1.0
AN0444 WindowsDetects Kerberoasting attempts by monitoring for anomalous Kerberos TGS requests (Event ID 4769) with RC4 encryption (etype 0x17), accounts requesting an unusual number of service tickets in a short period, or service accounts targeted outside normal usage baselines. Also correlates suspicious process activity (e.g., Mimikatz invoking LSASS access) with Kerberos ticket anomalies.Tunable:
TGSRequestThresholdAllowedEncryptionTypesServiceAccountBaselinesTimeWindow
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1558.003
Author: Florian Roth (Nextron Systems)
· 2022-04-26 (modified 2023-02-04) · logsource: product=windows category=process_creation · 12827a56-61a4-476a-a9cb-f3068f191073
Detects KrbRelayUp used to perform a universal no-fix local privilege escalation in Windows domain environments where LDAP signing is not enforced
Author: Roberto Rodriguez (source), Ilyas Ochkov (rule), oscd.community
· 2019-10-24 (modified 2022-10-09) · logsource: product=windows service=security · 12e6d621-194f-4f59-90cc-1959e21e69f7
Detects potential use of Rubeus via registered new trusted logon process
Author: Markus Neis, keepwatch
· 2018-11-14 (modified 2023-10-23) · logsource: product=windows category=process_creation · 1eeed653-dbc8-4187-ad0c-eeebb20e6599
Detects service principal name (SPN) enumeration used for Kerberoasting
Author: Christian Burkard (Nextron Systems), Florian Roth (Nextron Systems)
· 2023-04-27 · logsource: product=windows category=ps_script · 3245cd30-e015-40ff-a31d-5cadd5f377ec
Detects the execution of the hacktool Rubeus using specific command line flags
Author: frack113
· 2021-12-15 (modified 2023-04-14) · logsource: product=windows service=system · 44bbff3e-4ca3-452d-a49a-6efa4cafa06f
The attacker creates a computer object using those permissions with a password known to her.
After that she clears the attribute ServicePrincipalName on the computer object.
Because she created the object (CREATOR OWNER), she gets granted additional permissions and can do many changes to the object.
Author: Florian Roth (Nextron Systems)
· 2017-02-06 (modified 2022-06-19) · logsource: product=windows service=security · 496a0e47-0a33-4dca-b009-9e6ca3591f39
Detects service ticket requests using RC4 encryption type
Author: sigma
· 2020-02-12 (modified 2021-11-27) · logsource: product=zeek service=kerberos · 503fe26e-b5f2-4944-a126-eab405cc06e5
Detects kerberos TGS request using RC4 encryption which may be indicative of kerberoasting
Author: Roberto Rodriguez (source), Ilyas Ochkov (rule), oscd.community
· 2019-10-24 (modified 2022-12-25) · logsource: product=windows service=security · 6daac7fc-77d1-449a-a71a-e6b4d59a0e54
The 'LsaRegisterLogonProcess' function verifies that the application making the function call is a logon process by checking that it has the SeTcbPrivilege privilege set. Possible Rubeus tries to get a handle to LSA.
Author: Florian Roth (Nextron Systems)
· 2018-12-19 (modified 2023-04-20) · logsource: product=windows category=process_creation · 7ec2c172-dceb-4c10-92c9-87c1881b7e18
Detects the execution of the hacktool Rubeus via PE information of command line parameters
Author: Nasreddine Bencherchali (Nextron Systems)
· 2024-06-27 · logsource: product=windows category=process_creation · a7664b14-75fb-4a50-a223-cb9bc0afbacf
Detects the use of RemoteKrbRelay, a Kerberos relaying tool via CommandLine flags and PE metadata.
Author: frack113
· 2021-12-28 (modified 2025-11-18) · logsource: product=windows category=ps_script · a861d835-af37-4930-bcd6-5b178bfb54df
Detects PowerShell scripts that utilize native PowerShell Identity modules to request Kerberos tickets.
This behavior is typically seen during a Kerberos or silver ticket attack. A successful execution will output the SPNs for the endpoint in question.
Author: @SerkinValery
· 2024-03-07 (modified 2025-09-22) · logsource: product=windows service=system · b1e0b3f5-b62e-41be-886a-daffde446ad4
Detects errors when a target server doesn't have suitable keys for generating kerberos tickets.
This issue can occur for example when a service uses a user account or a computer account that is configured for only DES encryption on a computer that is running Windows 7 which has DES encryption for Kerberos authentication disabled.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-11-18 · logsource: product=windows category=process_creation · caa9a802-8bd8-4b9e-a5cd-4d6221670219
Detects suspicious Kerberos ticket requests via command line using System.IdentityModel.Tokens.KerberosRequestorSecurityToken class.
Threat actors may use command line interfaces to request Kerberos tickets for service accounts in order to
perform offline password cracking attacks commonly known as Kerberoasting or other Kerberos ticket abuse
techniques like silver ticket attacks.
Author: @kostastsale
· 2022-01-21 (modified 2025-10-19) · logsource: product=windows service=security · d04ae2b8-ad54-4de0-bd87-4bc1da66aa59
This rule will collect the data needed to start looking into possible kerberoasting activity.
Further analysis or computation within the query is needed focusing on requests from one specific host/IP towards multiple service names within a time period of 5 seconds.
You can then set a threshold for the number of requests and time between the requests to turn this into an alert.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-07-29 · logsource: product=windows service=security · e3f7c841-2a9d-4b5e-c018-d94b3e67f012
Detects a Kerberos service ticket request (Event 4769) targeting a Domain Controller
machine account's service (e.g. DRSUAPI) originating from an IP address that is not a
known Domain Controller. Service tickets for DC machine accounts should only be requested
by other DCs during legitimate replication operations.
An attacker with a valid TGT (obtained via PKINIT, overpass-the-hash, or stolen TGT)
targeting a DC machine account's service from a workstation IP indicates preparation for
DCSync or impersonation of a DC. Unlike Silver Ticket attacks (which forge the TGS and
bypass this event), this rule catches attacks that go through the KDC legitimately.
This rule requires %dc_machine_accounts% and %dc_ip_addresses% to be populated with
all known DC machine account names and DC IP addresses respectively.
Author: frack113
· 2021-12-15 (modified 2023-04-14) · logsource: product=windows service=system · e80a0fee-1a62-4419-b31e-0d0db6e6013a
The attacker creates a computer object using those permissions with a password known to her.
After that she clears the attribute ServicePrincipalName on the computer object.
Because she created the object (CREATOR OWNER), she gets granted additional permissions and can do many changes to the object.
Author: Florian Roth (Nextron Systems)
· 2022-04-27 (modified 2023-02-04) · logsource: product=windows category=process_creation · e96253b8-6b3b-4f90-9e59-3b24b99cf9b4
Detects the use of KrbRelay, a Kerberos relaying tool
Author: Ilyas Ochkov, oscd.community
· 2019-10-24 (modified 2024-03-15) · logsource: product=windows service=security · eca91c7c-9214-47b9-b4c5-cb1d7e4f2350
Detects uncommon outbound network activity via Kerberos default port indicating possible lateral movement or first stage PrivEsc via delegation.
Rules tagged at the parent level (attack.t1558) 6
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: frack113
· 2022-10-14 · logsource: product=windows service=security · 5a44727c-3b85-4713-8c44-4401d5499629
Detects possible Kerberos Replay Attack on the domain controllers when "KRB_AP_ERR_REPEAT" Kerberos response is sent to the client
Author: Florian Roth (Nextron Systems), Arnim Rupp
· 2018-09-09 (modified 2026-06-15) · logsource: category=antivirus · 78cc2dd2-7d20-4d32-93ff-057084c38b93
Detects a highly relevant Antivirus alert that reports password dumpers and stealers.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place and check if passwords need to be reset.
Author: frack113
· 2022-10-14 (modified 2023-12-14) · logsource: product=windows service=security · 94309181-d345-4cbf-b5fe-061769bdf9cb
Detects logon with "Special groups" and "Special Privileges" can be thought of as Administrator groups or privileges.
Author: Florian Roth (Nextron Systems), David ANDRE
· 2021-11-08 (modified 2024-06-27) · logsource: product=windows category=file_event · 9e099d99-44c2-42b6-a6d8-54c3545cab29
Detects the creation of files created by mimikatz such as ".kirbi", "mimilsa.log", etc.
Author: frack113
· 2025-03-05 · logsource: product=windows category=ps_script · cdfa73b6-3c9d-4bb8-97f8-ddbd8921f5c5
Detects the use of the "Get-ADComputer" cmdlet in order to identify systems which are configured for unconstrained delegation.
Author: Ilyas Ochkov, oscd.community
· 2019-10-24 (modified 2024-03-15) · logsource: product=windows category=network_connection · e54979bd-c5f9-4d6c-967b-a04b19ac4c74
Detects uncommon outbound network activity via Kerberos default port indicating possible lateral movement or first stage PrivEsc via delegation.