1. Home
  2. ATT&CK Techniques
  3. T1558.003 Kerberoasting

T1558.003 Kerberoasting Mappings

Adversaries may abuse a valid Kerberos ticket-granting ticket (TGT) or sniff network traffic to obtain a ticket-granting service (TGS) ticket that may be vulnerable to Brute Force.(Citation: Empire InvokeKerberoast Oct 2016)(Citation: AdSecurity Cracking Kerberos Dec 2015)

Service principal names (SPNs) are used to uniquely identify each instance of a Windows service. To enable authentication, Kerberos requires that SPNs be associated with at least one service logon account (an account specifically tasked with running a service(Citation: Microsoft Detecting Kerberoasting Feb 2018)).(Citation: Microsoft SPN)(Citation: Microsoft SetSPN)(Citation: SANS Attacking Kerberos Nov 2014)(Citation: Harmj0y Kerberoast Nov 2016)

Adversaries possessing a valid Kerberos ticket-granting ticket (TGT) may request one or more Kerberos ticket-granting service (TGS) service tickets for any SPN from a domain controller (DC).(Citation: Empire InvokeKerberoast Oct 2016)(Citation: AdSecurity Cracking Kerberos Dec 2015) Portions of these tickets may be encrypted with the RC4 algorithm, meaning the Kerberos 5 TGS-REP etype 23 hash of the service account associated with the SPN is used as the private key and is thus vulnerable to offline Brute Force attacks that may expose plaintext credentials.(Citation: AdSecurity Cracking Kerberos Dec 2015)(Citation: Empire InvokeKerberoast Oct 2016) (Citation: Harmj0y Kerberoast Nov 2016)

This same behavior could be executed using service tickets captured from network traffic.(Citation: AdSecurity Cracking Kerberos Dec 2015)

Cracked hashes may enable Persistence, Privilege Escalation, and Lateral Movement via access to Valid Accounts.(Citation: SANS Attacking Kerberos Nov 2014)

View in MITRE ATT&CK®

NIST 800-53 Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
CA-07 Continuous Monitoring mitigates T1558.003 Kerberoasting
CM-06 Configuration Settings mitigates T1558.003 Kerberoasting
CM-05 Access Restrictions for Change mitigates T1558.003 Kerberoasting
IA-05 Authenticator Management mitigates T1558.003 Kerberoasting
AC-17 Remote Access mitigates T1558.003 Kerberoasting
AC-19 Access Control for Mobile Devices mitigates T1558.003 Kerberoasting
SC-04 Information in Shared System Resources mitigates T1558.003 Kerberoasting
SI-12 Information Management and Retention mitigates T1558.003 Kerberoasting
SI-03 Malicious Code Protection mitigates T1558.003 Kerberoasting
SI-07 Software, Firmware, and Information Integrity mitigates T1558.003 Kerberoasting
AC-16 Security and Privacy Attributes mitigates T1558.003 Kerberoasting
AC-18 Wireless Access mitigates T1558.003 Kerberoasting
CM-02 Baseline Configuration mitigates T1558.003 Kerberoasting
IA-02 Identification and Authentication (Organizational Users) mitigates T1558.003 Kerberoasting
SI-04 System Monitoring mitigates T1558.003 Kerberoasting
AC-02 Account Management mitigates T1558.003 Kerberoasting
AC-03 Access Enforcement mitigates T1558.003 Kerberoasting
AC-05 Separation of Duties mitigates T1558.003 Kerberoasting
AC-06 Least Privilege mitigates T1558.003 Kerberoasting

VERIS Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
action.malware.variety.Capture stored data Capture data stored on system disk related-to T1558.003 Kerberoasting
action.malware.variety.Export data Export data to another site or system related-to T1558.003 Kerberoasting
action.malware.variety.Password dumper Password dumper (extract credential hashes) related-to T1558.003 Kerberoasting
attribute.confidentiality.data_disclosure None related-to T1558.003 Kerberoasting
action.hacking.variety.Use of stolen creds Use of stolen or default authentication credentials (including credential stuffing) related-to T1558.003 Kerberoasting