🎯 Kerberoasting

The items that name it 16

• Artificial Intelligence (AI) in Cybersecurity, Part 28: Using ADStrike to Compromise Active Directory
  writeupas techniques2026-10-12

  Run by ADStrike against the lab domain, where a few roastable accounts were found; cracking success depends on the wordlist used.

• M-med/Active-Directory-Simulation-Attack-
  repoas classification.key entities2026-10-04
• The First 24 Hours: What Happens When Ransomware Lands
  writeupas techniques2026-10-02It is written here as Kerberoasting (T1558.003).

  Run against service accounts by Akira operators, per CISA advisory

• ADScanPro/Claude-AD
  repoas techniques2026-08-24

  Requesting service tickets to crack service account credentials; covered in kerberos-attacks skill with standard command, MITRE ID, detection events and fix

• hunt.md
  repoas techniques2026-08-17

  Example hunt in the page enumerates SPN requests via Kerberos service ticket requests with RC4 encryption (EventID 4769, TicketEncryptionType 0x17) to detect kerberoasting from non-admin workstations; hypothesis: service accounts are being kerberoasted from non-admin workstations

• Mimikatz Missing Manual
  repoas classification.key entities2026-07-31
• Orca Security: ITDR for the Cloud
  articleas techniques2026-07-03
• mukul975/Anthropic-Cybersecurity-Skills
  repoas techniques2026-05-26

  Cited as an example technique detectable via Sigma rules

• elementalsouls/Claude-BugHunter
  repoas techniques2026-05-22

  internal AD attack technique; mentioned as out of scope for this bundle

• The OID Problem: Writing LDAP Detections That Actually Work
  writeupas classification.key entities2025-12-16
• 6 Months of Researching OAuth Application Attacks | Huntress
  writeupas techniques2025-02-10

  Cited as an analogy for exploitation primitives that are unpatchable features rather than bugs

• Tear Down The Castle - Part 2
  writeupas techniques2025-01-30

  Requesting a TGS ticket for a service account (SPN populated) encrypted with a derivative of the service password, then brute-forcing it offline to recover the plaintext password; affects at least one admin group member in 95/250 domains

• PerfMon! What Is It Good For? | Huntress
  writeupas techniques2025-01-23

  Attack demonstrated via Rubeus causing mass TGS requests by a single account and an LDAP query with serviceprincipalname=*, detected via PerfMon/Active Directory Diagnostics traces

• Tear Down The Castle - Part 1
  writeupas techniques2025-01-19

  Requesting a TGS for an SPN-associated (service) account and offline-cracking the ticket to recover the account password; admin accounts kerberoastable in 95/250 domains

• Zero-point Security's Red Team Ops (CRTO) review
  writeupas techniques2022-05-01

  Known Active Directory attack technique taught in the course, followed by a guided lab

• Kerberosity Killed the Domain: An Offensive Kerberos Overview
  articleas techniques2020-03-10

  Requesting a TGS for a service principal (often a user account registered as an SPN) since the KDC performs no authorization check, then extracting and offline-cracking the service account password hash used to encrypt the TGS