T1558.003 Kerberoasting

Technique

T1558.003

Tactics

Credential Access

Research, 90 days

1

KEV CVEs mapped

0

SigmaHQ rules

17

Elastic, Splunk

17

thrunt rules

0

Upstream

https://attack.mitre.org/techniques/T1558/003

MITRE description

Adversaries may abuse a valid Kerberos ticket-granting ticket (TGT) or sniff network traffic to obtain a ticket-granting service (TGS) ticket that may be vulnerable to [Brute Force](https://attack.mitre.org/techniques/T1110).(Citation: Empire InvokeKerberoast Oct 2016)(Citation: AdSecurity Cracking Kerberos Dec 2015) Service principal names (SPNs) are used to uniquely identify each instance of a Windows service. To enable authentication, Kerberos requires that SPNs be associated with at least one service logon account (an account specifically tasked with running a service).(Citation: Microsoft Detecting Kerberoasting Feb 2018)(Citation: Microsoft SPN)(Citation: Microsoft SetSPN)(Citation: SANS Attacking Kerberos Nov 2014)(Citation: Harmj0y Kerberoast Nov 2016) Adversaries possessing a valid Kerberos ticket-granting ticket (TGT) may request one or more Kerberos ticket-granting service (TGS) service tickets for any SPN from a domain controller (DC).(Citation: Empire InvokeKerberoast Oct 2016)(Citation: AdSecurity Cracking Kerberos Dec 2015) Portions of these tickets may be encrypted with the RC4 algorithm, meaning the Kerberos 5 TGS-REP etype 23 hash of the service account associated with the SPN is used as the private key and is thus vulnerable to offline [Brute Force](https://attack.mitre.org/techniques/T1110) attacks that may expose plaintext credentials.(Citation: AdSecurity Cracking Kerberos Dec 2015)(Citation: Empire InvokeKerberoast Oct 2016)(Citation: Harmj0y Kerberoast Nov 2016) This same behavior could be executed using service tickets captured from network traffic.(Citation: AdSecurity Cracking Kerberos Dec 2015) Cracked hashes may enable [Persistence](https://attack.mitre.org/tactics/TA0003), [Privilege Escalation](https://attack.mitre.org/tactics/TA0004), and [Lateral Movement](https://attack.mitre.org/tactics/TA0008) via access to [Valid Accounts](https://attack.mitre.org/techniques/T1078).(Citation: SANS Attacking Kerberos Nov 2014)

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

• 2026-10-21 Group-IB: Stray Cat, Open Doors: How k0t Wanders Through the Network Edge

Detection coverage

SigmaHQ community rules

• Potential CVE-2021-42278 Exploitation Attempt (emerging-threats)
• Potential CVE-2021-42287 Exploitation Attempt (emerging-threats)
• Kerberos Network Traffic RC4 Ticket Encryption (core)
• Kerberoasting Activity - Initial Query (core)
• Register new Logon Process by Rubeus (core)
• Uncommon Outbound Kerberos Connection - Security (core)
• Suspicious Kerberos RC4 Ticket Encryption (core)
• User Couldn't Call a Privileged Service 'LsaRegisterLogonProcess (core)
• No Suitable Encryption Key Found For Generating Kerberos Ticket (core)
• HackTool - Rubeus Execution - ScriptBlock (core)
• Suspicious Kerberos Ticket Request via PowerShell Script - ScriptBlock (core)
• HackTool - RemoteKrbRelay Execution (core)
• HackTool - KrbRelay Execution (core)
• HackTool - KrbRelayUp Execution (core)
• HackTool - Rubeus Execution (core)
• Suspicious Kerberos Ticket Request via CLI (core)
• Potential SPN Enumeration Via Setspn.EXE (core)

Elastic and Splunk rules

• Kerberos Cached Credentials Dumping (elastic)
• Potential Kerberos Attack via Bifrost (elastic)
• Kerberos Traffic from Unusual Process (elastic)
• Newly Observed RC4 Kerberos Service Ticket Request (elastic)
• PowerShell Kerberos Ticket Request (elastic)
• User account exposed to Kerberoasting (elastic)
• Potential PowerShell HackTool Script by Function Names (elastic)
• Suspicious Kerberos Authentication Ticket Request (elastic)
• Kerberoasting spn request with RC4 encryption (splunk)
• Rubeus Command Line Parameters (splunk)
• ServicePrincipalNames Discovery with PowerShell (splunk)
• ServicePrincipalNames Discovery with SetSPN (splunk)
• Unusual Number of Kerberos Service Tickets Requested (splunk)
• Windows AD Computer SPN Modified By User Account (splunk)
• Windows PowerView Kerberos Service Ticket Request (splunk)
• Windows PowerView SPN Discovery (splunk)
• Windows Process With NetExec Command Line Parameters (splunk)

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) at release r2026-07-01 plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.