Active Directory Exploitation: Mitigating Kerberoasting & AS-REP Roasting

The Mechanics of Kerberoasting

In Active Directory, any authenticated domain user can request a Kerberos service ticket (TGS) for any service account holding a Service Principal Name (SPN). Because the ticket is encrypted with the service account's password hash, the attacker extracts the ticket and cracks it offline without generating failed login events.

The Power of Group Managed Service Accounts (gMSA)

Migrate all legacy service accounts with SPNs to Group Managed Service Accounts (gMSAs). gMSAs utilize complex, randomly generated 128-character passwords rotated automatically by domain controllers every 30 days, making offline brute-forcing mathematically impossible.

Detecting Ticket Requests with Honey Accounts

Create an attractive decoy service account with an SPN and configure SIEM alerts to trigger whenever Event ID 4769 (Kerberos ticket requested with RC4 encryption) is logged against the decoy.