--- title: Kerberoasting Attack Explained Step by Step | daily.dev description: Kerberoasting is an Active Directory attack that abuses the Kerberos protocol to steal service account passwords. Any authenticated domain user can request a... canonical: https://daily.dev/posts/kerberoasting-attack-explained-step-by-step-n90us9ovx twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Kerberoasting Attack Explained Step by Step | daily.dev og:description: Kerberoasting is an Active Directory attack that abuses the Kerberos protocol to steal service account passwords. Any authenticated domain user can request a... og:url: https://daily.dev/posts/kerberoasting-attack-explained-step-by-step-n90us9ovx og:image: https://api.daily.dev/og/posts/N90US9OVX.png og:image:alt: Kerberoasting Attack Explained Step by Step og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Kerberoasting Attack Explained Step by Step **[Latest Hacking News](https://daily.dev/sources/lhn)** · 7 min read · 0 upvotes · 0 comments ## Summary Kerberoasting is an Active Directory attack that abuses the Kerberos protocol to steal service account passwords. Any authenticated domain user can request a TGS ticket for any SPN, then crack it offline using tools like Hashcat. The attack is popular because it requires no special privileges and doesn't trigger account lockouts. Detection relies on monitoring Windows Event ID 4769 for anomalous SPN requests or RC4 ticket requests. Defenses include migrating service accounts to Group Managed Service Accounts (gMSA), enforcing AES256 encryption, using long randomly generated passwords, auditing SPN assignments, and deploying honeypot accounts to catch reconnaissance early. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [HTB: Mirage](https://daily.dev/posts/htb-mirage-jymabso8x) · 0xdf hacks stuff · 1 upvotes · 0 comments - [VulnNet Roasted — TryHackMe Active Directory Write-up](https://daily.dev/posts/vulnnet-roasted-tryhackme-active-directory-write-up-cwhmcslly) · InfoSec Write-ups · 0 upvotes · 0 comments - [HTB: Breach](https://daily.dev/posts/htb-breach-mzot368ee) · 0xdf hacks stuff · 1 upvotes · 0 comments - [Why Changing Passwords Doesn’t End an Active Directory Breach](https://daily.dev/posts/why-changing-passwords-doesn-t-end-an-active-directory-breach-psjagvbxx) · BleepingComputer · 0 upvotes · 0 comments - [How NAD in KATA detects Kerberoasting and DNS tunneling](https://daily.dev/posts/how-nad-in-kata-detects-kerberoasting-and-dns-tunneling-06tkydusi) · Securelist · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#active-directory](https://daily.dev/tags/active-directory), [#kerberos](https://daily.dev/tags/kerberos) [View this post on daily.dev](https://daily.dev/posts/kerberoasting-attack-explained-step-by-step-n90us9ovx) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Kerberoasting Attack Explained Step by Step","url":"https://daily.dev/posts/kerberoasting-attack-explained-step-by-step-n90us9ovx","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/kerberoasting-attack-explained-step-by-step-n90us9ovx"},"datePublished":"2026-07-09T22:17:25.885Z","dateModified":"2026-07-09T22:17:45.468Z","description":"Kerberoasting is an Active Directory attack that abuses the Kerberos protocol to steal service account passwords. Any authenticated domain user can request a...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0b6afc984ac61b6e34d0de75c55c93cd?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0b6afc984ac61b6e34d0de75c55c93cd?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Latest Hacking News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Latest Hacking News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/5110318ded6e43f1bb12facdeb2b1965","url":"https://daily.dev/sources/lhn"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/kerberoasting-attack-explained-step-by-step-n90us9ovx","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,active-directory,kerberos","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Latest Hacking News","item":"https://daily.dev/sources/lhn"},{"@type":"ListItem","position":3,"name":"Kerberoasting Attack Explained Step by Step"}]} ```