Active › Module 5 › Lesson 1
Kerberoast Named
Kerberoast names TGS offline-crack class against user SPNs — recognize and mitigate on $LAB_AD literacy; no Rubeus fire recipes.
Visual · t25_kerberoast_named
Kerberoast class literacy. $LAB_AD only. Original Cyberlium.
Opening
Kerberoast is a named class — defenders fix SPN hygiene; Cyberlium does not ship roast cookbooks against strangers.
Kerberoast class: authenticated user requests service tickets (TGS) for accounts with SPNs, typically user accounts, then attempts offline password crack against ticket encryption. Requires no special privilege beyond valid domain user in many configurations — impact depends on service account password strength. Cyberlium names Kerberoast with mitigations on YOUR $LAB_AD — gMSA, long random passwords, reduce user SPNs, monitor 4769 anomalies — not step-by-step Rubeus/Impacket commands against unauthorized domains. Next: AS-REP Named.
1. Kerberoast class (named, no cookbook)
Trigger: TGS-REQ for SPN on user account. Risk: offline crack if password weak. Not magic — mitigated by modern password policy, gMSA, and detection of unusual TGS volume or RC4 preference.
On $LAB_AD, write class card: prerequisite, artifact (TGS), impact, detection — zero command lines aimed at stranger domains.
Command guide
Try these commands — Kerberoast class (named, no cookbook)
═══ WINDOWS / POWERSHELL (Lab DC or Joined Machine) ═══
Enumerate user accounts that have a Service Principal Name (SPN) configured
Command — copy this
Get-ADUser -Filter {ServicePrincipalName -like "*"} -Properties ServicePrincipalName | Select-Object SamAccountName, ServicePrincipalNameRequest a TGS ticket for an SPN on your lab domain (Defender testing)
Command — copy this
Add-Type -AssemblyName System.IdentityModel New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken -ArgumentList "HTTP/webserver.lab.local"
View cached Kerberos tickets (look for ticket encryption: RC4 vs AES)
Command — copy this
klist
═══ DEFENDER AUDITING ═══ Monitor Event ID 4769 in Windows Security Log for TGS requests (Ticket Encryption 0x17 = RC4)
Command — copy this
Get-WinEvent -FilterHashtable @{LogName='Security';Id=4769} -MaxEvents 5 -ErrorAction SilentlyContinue | Format-List TimeCreated, MessagePrimary tools to practice this lesson: curl, python3. Reference sites: MITRE T1558.003 Kerberoasting (https://attack.mitre.org/techniques/T1558/003/); Microsoft Kerberos auditing (https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4769); adsecurity.org Kerberoasting (https://adsecurity.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Defender mitigations (primary output)
Use gMSA for services. 25+ character random passwords on any remaining user SPNs. Remove unnecessary SPNs. Monitor Event 4769 for unusual service names, encryption types, and source hosts. Tier service accounts.
Purple-team finding format: 'Kerberoast class risk on svc_sql — recommend gMSA migration' — not cracked hash paste.
3. Refusal boundary
Forbidden: 'run Rubeus kerberoast owrap' against production or tutorial domains. Allowed: mitigation table and detection rule draft for $LAB_AD purple report.
Ship: Kerberoast class card — definition, three mitigations, two detection ideas. Next: AS-REP Named.
4. What you ship: Kerberoast class card for $LAB_AD
Class definition, mitigations, detection notes. $LAB_AD named. NO roast commands. chmod 600.
5. What you record before the next lesson
Date. Kerberoast card. $LAB_AD named. File t25-m05-l01-kerberoast-named.txt chmod 600.
6. Wrong vs right: stranger-domain attacks vs lab AD literacy
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Roast all SPNs on corporate AD. Share cracked service passwords in chat.
Right
Write Kerberoast class card with mitigations for YOUR $LAB_AD. Next: AS-REP Named.
Mission: name Kerberoast class
1) Define class in one paragraph. 2) List three mitigations. 3) Name two detection signals. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
gMSA migration is the remediation executives understand.
Knowledge Check
APPLY: Kerberoast literacy on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: gMSA reduces Kerberoast class risk for services.
True or False
Knowledge Check
APPLY: Primary defender response to Kerberoast class:
Multiple choice