Kerberoasting
Request a Kerberos service ticket for an SPN account, take it offline, and crack the password hash. Any authenticated user can try.
Kerberoasting abuses a normal Kerberos step. Any authenticated domain user can ask a Domain Controller for a Ticket Granting Service (TGS) ticket for an account that has a Service Principal Name (SPN). That ticket is encrypted with a key derived from the service account's password. Offline cracking turns the ticket into that password.
Service accounts with short or reused passwords, and especially those in Domain Admins, are the usual prize. Mitigation is group Managed Service Accounts where possible, long unique passwords otherwise, AES-only encryption, no privileged group membership on SPN accounts, and detection on noisy 4769 patterns.
Kerberoasting is one of the seventeen techniques in ASD / CISA guidance on detecting and mitigating Active Directory compromises. See also the CyberStack Active Directory compromise guide.
See also:
Fact source: ASD's ACSC — Detecting and mitigating Active Directory compromises (Sep 2026).