What is Kerberoasting?
Kerberoasting is an attack on Active Directory in which any logged-in user requests service tickets for accounts that run services, then takes the tickets away and cracks them offline to recover those accounts' passwords. It needs no special rights, makes little noise and works best against service accounts with weak, old passwords, which often have broad privileges. Defences are long random passwords for service accounts, preferably managed service accounts that rotate automatically, strong encryption types for Kerberos, and alerts in the directory's logs when one host requests many service tickets in a short time. The ticket requests are directory events, visible to identity monitoring rather than to a flow sensor. NetSenX does not alert on Kerberos activity; it sees what the cracked accounts are then used for, such as new administrative sessions to servers.