{"id":"T1558.003","name":"Kerberoasting","url":"https://attack.mitre.org/techniques/T1558/003","tactics":["credential-access"],"platforms":["Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0157","stix_id":"x-mitre-detection-strategy--f1fe6286-1f54-4dfc-b96a-31b10711e4b1","name":"Detect Kerberoasting Attempts (T1558.003)","url":"https://attack.mitre.org/detectionstrategies/DET0157","analytics":[{"id":"AN0444","stix_id":"x-mitre-analytic--4ab972bf-623b-418b-9647-2c3a56b55083","name":"Analytic 0444","description":"Detects Kerberoasting attempts by monitoring for anomalous Kerberos TGS requests (Event ID 4769) with RC4 encryption (etype 0x17), accounts requesting an unusual number of service tickets in a short period, or service accounts targeted outside normal usage baselines. Also correlates suspicious process activity (e.g., Mimikatz invoking LSASS access) with Kerberos ticket anomalies.","url":"https://attack.mitre.org/detectionstrategies/DET0157#AN0444","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=4769","data_component":"DC0084","data_component_name":"Active Directory Credential Request","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Sysmon","channel":"EventCode=10","data_component":"DC0035","data_component_name":"Process Access","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Security","channel":"EventCode=4624, 4648","data_component":"DC0067","data_component_name":"Logon Session Creation","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Security","channel":"EventCode=4672","data_component":"DC0088","data_component_name":"Logon Session Metadata","log_source_slug":"wineventlog-security"}],"mutable_elements":[{"field":"TGSRequestThreshold","description":"Number of TGS requests per account within a defined window; higher than baseline may indicate Kerberoasting."},{"field":"AllowedEncryptionTypes","description":"Permitted Kerberos encryption algorithms; RC4 (etype 0x17) usage in modern environments is suspicious."},{"field":"ServiceAccountBaselines","description":"Expected SPNs requested by specific accounts; anomalies may indicate adversarial targeting."},{"field":"TimeWindow","description":"Correlation window for bursts of TGS requests; adjustable to reduce false positives."}],"live":true,"detection_strategies":["DET0157"],"techniques":["T1558.003"]}],"live":true,"version":"1.0","techniques":["T1558.003"]}],"sigma_rules":[{"id":"12827a56-61a4-476a-a9cb-f3068f191073","title":"HackTool - KrbRelayUp Execution","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-04-26","modified":"2023-02-04","description":"Detects KrbRelayUp used to perform a universal no-fix local privilege escalation in Windows domain environments where LDAP signing is not enforced","references":["https://github.com/Dec0ne/KrbRelayUp"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.t1558.003","attack.lateral-movement","attack.t1550.003"],"path":"rules/windows/process_creation/proc_creation_win_hktl_krbrelayup.yml","techniques":["T1558.003","T1550.003"],"cves":[]},{"id":"12e6d621-194f-4f59-90cc-1959e21e69f7","title":"Register new Logon Process by Rubeus","author":"Roberto Rodriguez (source), Ilyas Ochkov (rule), oscd.community","status":"test","level":"high","date":"2019-10-24","modified":"2022-10-09","description":"Detects potential use of Rubeus via registered new trusted logon process","references":["https://posts.specterops.io/hunting-in-active-directory-unconstrained-delegation-forests-trusts-71f2b33688e1"],"logsource":{"product":"windows","service":"security"},"tags":["attack.lateral-movement","attack.privilege-escalation","attack.credential-access","attack.t1558.003"],"path":"rules/windows/builtin/security/win_security_register_new_logon_process_by_rubeus.yml","techniques":["T1558.003"],"cves":[]},{"id":"1eeed653-dbc8-4187-ad0c-eeebb20e6599","title":"Potential SPN Enumeration Via Setspn.EXE","author":"Markus Neis, keepwatch","status":"test","level":"medium","date":"2018-11-14","modified":"2023-10-23","description":"Detects service principal name (SPN) enumeration used for Kerberoasting","references":["https://web.archive.org/web/20200329173843/https://p16.praetorian.com/blog/how-to-use-kerberoasting-t1208-for-privilege-escalation","https://www.praetorian.com/blog/how-to-use-kerberoasting-t1208-for-privilege-escalation/?edition=2019"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.t1558.003"],"path":"rules/windows/process_creation/proc_creation_win_setspn_spn_enumeration.yml","techniques":["T1558.003"],"cves":[]},{"id":"3245cd30-e015-40ff-a31d-5cadd5f377ec","title":"HackTool - Rubeus Execution - ScriptBlock","author":"Christian Burkard (Nextron Systems), Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2023-04-27","modified":null,"description":"Detects the execution of the hacktool Rubeus using specific command line flags","references":["https://blog.harmj0y.net/redteaming/from-kekeo-to-rubeus","https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html","https://github.com/GhostPack/Rubeus"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.credential-access","attack.t1003","attack.t1558.003","attack.lateral-movement","attack.t1550.003"],"path":"rules/windows/powershell/powershell_script/posh_ps_hktl_rubeus.yml","techniques":["T1003","T1558.003","T1550.003"],"cves":[]},{"id":"44bbff3e-4ca3-452d-a49a-6efa4cafa06f","title":"Potential CVE-2021-42278 Exploitation Attempt","author":"frack113","status":"test","level":"medium","date":"2021-12-15","modified":"2023-04-14","description":"The attacker creates a computer object using those permissions with a password known to her.\nAfter that she clears the attribute ServicePrincipalName on the computer object.\nBecause she created the object (CREATOR OWNER), she gets granted additional permissions and can do many changes to the object.\n","references":["https://cloudbrothers.info/en/exploit-kerberos-samaccountname-spoofing/"],"logsource":{"product":"windows","service":"system"},"tags":["attack.credential-access","attack.t1558.003","cve.2021-42278","detection.emerging-threats"],"path":"rules-emerging-threats/2021/Exploits/CVE-2021-42278/win_system_exploit_cve_2021_42278.yml","techniques":["T1558.003"],"cves":["CVE-2021-42278"]},{"id":"496a0e47-0a33-4dca-b009-9e6ca3591f39","title":"Suspicious Kerberos RC4 Ticket Encryption","author":"Florian Roth (Nextron Systems)","status":"test","level":"medium","date":"2017-02-06","modified":"2022-06-19","description":"Detects service ticket requests using RC4 encryption type","references":["https://adsecurity.org/?p=3458","https://www.trimarcsecurity.com/single-post/TrimarcResearch/Detecting-Kerberoasting-Activity"],"logsource":{"product":"windows","service":"security"},"tags":["attack.credential-access","attack.t1558.003"],"path":"rules/windows/builtin/security/win_security_susp_rc4_kerberos.yml","techniques":["T1558.003"],"cves":[]},{"id":"503fe26e-b5f2-4944-a126-eab405cc06e5","title":"Kerberos Network Traffic RC4 Ticket Encryption","author":"sigma","status":"test","level":"medium","date":"2020-02-12","modified":"2021-11-27","description":"Detects kerberos TGS request using RC4 encryption which may be indicative of kerberoasting","references":["https://adsecurity.org/?p=3458"],"logsource":{"product":"zeek","service":"kerberos"},"tags":["attack.credential-access","attack.t1558.003"],"path":"rules/network/zeek/zeek_susp_kerberos_rc4.yml","techniques":["T1558.003"],"cves":[]},{"id":"6daac7fc-77d1-449a-a71a-e6b4d59a0e54","title":"User Couldn't Call a Privileged Service 'LsaRegisterLogonProcess'","author":"Roberto Rodriguez (source), Ilyas Ochkov (rule), oscd.community","status":"test","level":"high","date":"2019-10-24","modified":"2022-12-25","description":"The 'LsaRegisterLogonProcess' function verifies that the application making the function call is a logon process by checking that it has the SeTcbPrivilege privilege set. Possible Rubeus tries to get a handle to LSA.","references":["https://posts.specterops.io/hunting-in-active-directory-unconstrained-delegation-forests-trusts-71f2b33688e1"],"logsource":{"product":"windows","service":"security"},"tags":["attack.credential-access","attack.lateral-movement","attack.privilege-escalation","attack.t1558.003"],"path":"rules/windows/builtin/security/win_security_user_couldnt_call_priv_service_lsaregisterlogonprocess.yml","techniques":["T1558.003"],"cves":[]},{"id":"7ec2c172-dceb-4c10-92c9-87c1881b7e18","title":"HackTool - Rubeus Execution","author":"Florian Roth (Nextron Systems)","status":"stable","level":"critical","date":"2018-12-19","modified":"2023-04-20","description":"Detects the execution of the hacktool Rubeus via PE information of command line parameters","references":["https://blog.harmj0y.net/redteaming/from-kekeo-to-rubeus","https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html","https://github.com/GhostPack/Rubeus"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.t1003","attack.t1558.003","attack.lateral-movement","attack.t1550.003"],"path":"rules/windows/process_creation/proc_creation_win_hktl_rubeus.yml","techniques":["T1003","T1558.003","T1550.003"],"cves":[]},{"id":"a7664b14-75fb-4a50-a223-cb9bc0afbacf","title":"HackTool - RemoteKrbRelay Execution","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2024-06-27","modified":null,"description":"Detects the use of RemoteKrbRelay, a Kerberos relaying tool via CommandLine flags and PE metadata.\n","references":["https://github.com/CICADA8-Research/RemoteKrbRelay"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.t1558.003"],"path":"rules/windows/process_creation/proc_creation_win_hktl_krbrelay_remote.yml","techniques":["T1558.003"],"cves":[]},{"id":"a861d835-af37-4930-bcd6-5b178bfb54df","title":"Suspicious Kerberos Ticket Request via PowerShell Script - ScriptBlock","author":"frack113","status":"test","level":"high","date":"2021-12-28","modified":"2025-11-18","description":"Detects PowerShell scripts that utilize native PowerShell Identity modules to request Kerberos tickets.\nThis behavior is typically seen during a Kerberos or silver ticket attack. A successful execution will output the SPNs for the endpoint in question.\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1558.003/T1558.003.md#atomic-test-4---request-a-single-ticket-via-powershell","https://learn.microsoft.com/en-us/dotnet/api/system.identitymodel.tokens.kerberosrequestorsecuritytoken?view=netframework-4.8.1"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.credential-access","attack.t1558.003"],"path":"rules/windows/powershell/powershell_script/posh_ps_request_kerberos_ticket.yml","techniques":["T1558.003"],"cves":[]},{"id":"b1e0b3f5-b62e-41be-886a-daffde446ad4","title":"No Suitable Encryption Key Found For Generating Kerberos Ticket","author":"@SerkinValery","status":"test","level":"low","date":"2024-03-07","modified":"2025-09-22","description":"Detects errors when a target server doesn't have suitable keys for generating kerberos tickets.\nThis issue can occur for example when a service uses a user account or a computer account that is configured for only DES encryption on a computer that is running Windows 7 which has DES encryption for Kerberos authentication disabled.\n","references":["https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd348773(v=ws.10)","https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/kdc-event-16-27-des-encryption-disabled"],"logsource":{"product":"windows","service":"system"},"tags":["attack.credential-access","attack.t1558.003"],"path":"rules/windows/builtin/system/microsoft_windows_kerberos_key_distribution_center/win_system_kdcsvc_tgs_no_suitable_encryption_key_found.yml","techniques":["T1558.003"],"cves":[]},{"id":"caa9a802-8bd8-4b9e-a5cd-4d6221670219","title":"Suspicious Kerberos Ticket Request via CLI","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-11-18","modified":null,"description":"Detects suspicious Kerberos ticket requests via command line using System.IdentityModel.Tokens.KerberosRequestorSecurityToken class.\nThreat actors may use command line interfaces to request Kerberos tickets for service accounts in order to\nperform offline password cracking attacks commonly known as Kerberoasting or other Kerberos ticket abuse\ntechniques like silver ticket attacks.\n","references":["https://www.huntress.com/blog/gootloader-threat-detection-woff2-obfuscation","https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1558.003/T1558.003.md#atomic-test-4---request-a-single-ticket-via-powershell","https://learn.microsoft.com/en-us/dotnet/api/system.identitymodel.tokens.kerberosrequestorsecuritytoken?view=netframework-4.8.1"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.t1558.003"],"path":"rules/windows/process_creation/proc_creation_win_powershell_kerberos_kerberos_ticket_request_via_cli.yml","techniques":["T1558.003"],"cves":[]},{"id":"d04ae2b8-ad54-4de0-bd87-4bc1da66aa59","title":"Kerberoasting Activity - Initial Query","author":"@kostastsale","status":"test","level":"medium","date":"2022-01-21","modified":"2025-10-19","description":"This rule will collect the data needed to start looking into possible kerberoasting activity.\nFurther analysis or computation within the query is needed focusing on requests from one specific host/IP towards multiple service names within a time period of 5 seconds.\nYou can then set a threshold for the number of requests and time between the requests to turn this into an alert.\n","references":["https://www.trustedsec.com/blog/art_of_kerberoast/","https://adsecurity.org/?p=3513"],"logsource":{"product":"windows","service":"security"},"tags":["attack.credential-access","attack.t1558.003"],"path":"rules/windows/builtin/security/win_security_kerberoasting_activity.yml","techniques":["T1558.003"],"cves":[]},{"id":"e3f7c841-2a9d-4b5e-c018-d94b3e67f012","title":"DC Machine Account TGS Request from Non-DC Source IP","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2026-07-29","modified":null,"description":"Detects a Kerberos service ticket request (Event 4769) targeting a Domain Controller\nmachine account's service (e.g. DRSUAPI) originating from an IP address that is not a\nknown Domain Controller. Service tickets for DC machine accounts should only be requested\nby other DCs during legitimate replication operations.\n\nAn attacker with a valid TGT (obtained via PKINIT, overpass-the-hash, or stolen TGT)\ntargeting a DC machine account's service from a workstation IP indicates preparation for\nDCSync or impersonation of a DC. Unlike Silver Ticket attacks (which forge the TGS and\nbypass this event), this rule catches attacks that go through the KDC legitimately.\n\nThis rule requires %dc_machine_accounts% and %dc_ip_addresses% to be populated with\nall known DC machine account names and DC IP addresses respectively.\n","references":["https://github.com/aniqfakhrul/CVE-2026-54121","https://gist.github.com/H0j3n/a5ef2609b5f2944ac2390a191a534c26","https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54121","https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4769"],"logsource":{"product":"windows","service":"security"},"tags":["attack.credential-access","attack.lateral-movement","attack.t1550.003","attack.t1558.003","cve.2026-54121"],"path":"rules-placeholder/windows/builtin/security/win_security_dc_machine_account_tgs_non_dc_ip.yml","techniques":["T1550.003","T1558.003"],"cves":["CVE-2026-54121"]},{"id":"e80a0fee-1a62-4419-b31e-0d0db6e6013a","title":"Potential CVE-2021-42287 Exploitation Attempt","author":"frack113","status":"test","level":"medium","date":"2021-12-15","modified":"2023-04-14","description":"The attacker creates a computer object using those permissions with a password known to her.\nAfter that she clears the attribute ServicePrincipalName on the computer object.\nBecause she created the object (CREATOR OWNER), she gets granted additional permissions and can do many changes to the object.\n","references":["https://cloudbrothers.info/en/exploit-kerberos-samaccountname-spoofing/"],"logsource":{"product":"windows","service":"system"},"tags":["attack.credential-access","attack.t1558.003","detection.emerging-threats","cve.2021-42287"],"path":"rules-emerging-threats/2021/Exploits/CVE-2021-42287/win_system_exploit_cve_2021_42287.yml","techniques":["T1558.003"],"cves":["CVE-2021-42287"]},{"id":"e96253b8-6b3b-4f90-9e59-3b24b99cf9b4","title":"HackTool - KrbRelay Execution","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-04-27","modified":"2023-02-04","description":"Detects the use of KrbRelay, a Kerberos relaying tool","references":["https://github.com/cube0x0/KrbRelay"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.t1558.003"],"path":"rules/windows/process_creation/proc_creation_win_hktl_krbrelay.yml","techniques":["T1558.003"],"cves":[]},{"id":"eca91c7c-9214-47b9-b4c5-cb1d7e4f2350","title":"Uncommon Outbound Kerberos Connection - Security","author":"Ilyas Ochkov, oscd.community","status":"test","level":"medium","date":"2019-10-24","modified":"2024-03-15","description":"Detects uncommon outbound network activity via Kerberos default port indicating possible lateral movement or first stage PrivEsc via delegation.\n","references":["https://github.com/GhostPack/Rubeus"],"logsource":{"product":"windows","service":"security"},"tags":["attack.lateral-movement","attack.credential-access","attack.t1558.003"],"path":"rules/windows/builtin/security/win_security_susp_outbound_kerberos_connection.yml","techniques":["T1558.003"],"cves":[]}],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}