RubeusS1071 ↗
Can reveal the credentials of accounts that have Kerberos pre-authentication disabled through AS-REP roasting.123
tfMITRE ATT&CK sub-technique
AS-REP Roasting T1558.004
sub-technique of T1558 Steal or Forge Kerberos Tickets
- Tactic
- Credential Access
- Platform
- Windows
- Version
- 1.2
- Created
- 24 August 2020
- Last modified
- 24 October 2025
- Contributors
- Yossi Nisani, Cymptom; James Dunn, @jamdunnDFW, EY; Swapnil Kumbhar; Jacques Pluviose, @Jacqueswildy_IT; Dan Nutting, @KerberToast
Adversaries may reveal credentials of accounts that have disabled Kerberos preauthentication by Password Cracking Kerberos messages.[1]
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
0
Threat groupsNone recorded
Threat groupsNone recorded · 29% of ATT&CK techniques have none either.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.1
Tools & malware44th pct
Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.6
Detection rules67th pct
Detection rules67th percentile · 67% of ATT&CK techniques have this many detection rules written or fewer.AS-REP Roasting MITRE reference T1558.004
44th pctamong all ATT&CK techniques for number of tools
1 software entry is documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
All 1 software entries for this technique
Offense vs defense T1558.004
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 0Sigma rules (cumulative) · 0Splunk ESCU (cumulative) · 6
first rule: 2022 Q1AS-REP Roasting detection strategy DET0113
MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detect AS-REP Roasting Attempts (T1558.004)
1 platform
AN0316 · Windows
Detects AS-REP roasting attempts by monitoring for Kerberos AS-REQ/AS-REP authentication patterns where preauthentication is disabled (Event ID 4768 with Pre-Auth Type 0). Correlates these requests with subsequent service ticket activity (Event ID 4769) and anomalies such as requests using weak RC4 encryption (etype 0x17). Excessive enumeration of accounts with 'Do not require Kerberos preauthentication' set in Active Directory is another key detection point.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| Active Directory Credential RequestDC0084 | WinEventLog:Security | EventCode=4768 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| PreAuthDisabledAccountsBaseline | Baseline of accounts legitimately configured without Kerberos preauthentication; deviations may indicate adversary enumeration. |
| TGTRequestThreshold | Number of AS-REQ/AS-REP exchanges per account within a short timeframe; higher counts may indicate AS-REP roasting. |
| AllowedEncryptionTypes | Permitted Kerberos encryption algorithms; RC4 usage (etype 0x17) should be closely monitored. |
| TimeWindow | Correlation window for linking AS-REQs, AS-REPs, and subsequent service ticket requests. |
AuditM1047
Kerberos preauthentication is enabled by default. Older protocols might not support preauthentication therefore it is possible to have this setting disabled. Make sure that all accounts have preauthentication whenever possible and audit changes to setting. Windows tools such as PowerShell may be used to easily find which accounts have preauthentication disabled.
Enable AES Kerberos encryption (or another stronger encryption algorithm), rather than RC4, where possible.
Password PoliciesM1027
Ensure strong password length (ideally 25+ characters) and complexity for service accounts and that these passwords periodically expire. Also consider using Group Managed Service Accounts or another third party product such as password vaulting.
Tests3ExecutorsPowerShell 3Need elevation0 of 3Have prerequisites1Have cleanup1Platformswindows
Tests from Atomic Red Team (MIT licence) · technique definition