# What is Kerberoasting?

Kerberoasting is an attack on Active Directory in which any logged-in user requests service tickets for accounts that run services, then takes the tickets away and cracks them offline to recover those accounts' passwords. It needs no special rights, makes little noise and works best against service accounts with weak, old passwords, which often have broad privileges. Defences are long random passwords for service accounts, preferably managed service accounts that rotate automatically, strong encryption types for Kerberos, and alerts in the directory's logs when one host requests many service tickets in a short time. The ticket requests are directory events, visible to identity monitoring rather than to a flow sensor. NetSenX does not alert on Kerberos activity; it sees what the cracked accounts are then used for, such as new administrative sessions to servers.

FAQ: [Attack techniques explained](https://netsenx.com/en/faq/attacks) · https://netsenx.com/en/faq/what-is-kerberoasting

## Read next

- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/is-someone-inside-your-network

## Related questions

- [What is pass-the-hash?](https://netsenx.com/en/faq/what-is-pass-the-hash)
- [What is a drive-by download?](https://netsenx.com/en/faq/what-is-a-drive-by-download)
- [What is a botnet, and how would we know a device of ours is part of one?](https://netsenx.com/en/faq/what-is-a-botnet)
- [What is a remote-access trojan (RAT)?](https://netsenx.com/en/faq/what-is-a-remote-access-trojan)
- [What is an initial access broker?](https://netsenx.com/en/faq/what-is-an-initial-access-broker)