Infosec Advanced: Kerberoasting

📰 Medium · Cybersecurity

Learn about Kerberoasting, a technique used by threat actors to attack Active Directory environments, and how to mitigate against it.

intermediate Published 19 Apr 2026

Action Steps

Understand the basics of Kerberos authentication and how service tickets are used to access resources in an Active Directory environment.
Learn about the MITRE technique T1558/003 and how it relates to Kerberoasting.
Familiarize yourself with Windows 4769 Event logs to detect potential Kerberoasting attacks.
Implement mitigation strategies such as monitoring and detecting suspicious service ticket requests.
Use tools and techniques to detect and prevent Kerberoasting attacks, such as analyzing network traffic and system logs.

Who Needs to Know This

Security teams and blue teams can benefit from understanding Kerberoasting to improve their defenses against threat actors. This knowledge can help them detect and prevent attacks, and improve their overall security posture.

Key Insight

💡 Kerberoasting exploits the way Kerberos handles authentication, allowing threat actors to obtain encrypted credentials and gain access to resources in an Active Directory environment.

Key Takeaways

Learn about Kerberoasting, a technique used by threat actors to attack Active Directory environments, and how to mitigate against it.

Full Article

Title: Infosec Advanced: Kerberoasting

URL Source: https://pkin1t.medium.com/infosec-advanced-kerberoasting-185f1a466f1f?source=rss------cybersecurity-5

Published Time: 2026-04-19T15:47:12Z

Markdown Content:
# Infosec Advanced: Kerberoasting. In a world where the majority of… | by pkin1t | Apr, 2026 | Medium

[Sitemap](https://pkin1t.medium.com/sitemap/sitemap.xml)

[Open in app](https://play.google.com/store/apps/details?id=com.medium.reader&referrer=utm_source%3DmobileNavBar&source=post_page---top_nav_layout_nav-----------------------------------------)

Sign up

[Sign in](https://medium.com/m/signin?operation=login&redirect=https%3A%2F%2Fpkin1t.medium.com%2Finfosec-advanced-kerberoasting-185f1a466f1f&source=post_page---top_nav_layout_nav-----------------------global_nav------------------)

[](https://medium.com/?source=post_page---top_nav_layout_nav-----------------------------------------)

Get app

[Write](https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fmedium.com%2Fnew-story&source=---top_nav_layout_nav-----------------------new_post_topnav------------------)

[Search](https://medium.com/search?source=post_page---top_nav_layout_nav-----------------------------------------)

Sign up

[Sign in](https://medium.com/m/signin?operation=login&redirect=https%3A%2F%2Fpkin1t.medium.com%2Finfosec-advanced-kerberoasting-185f1a466f1f&source=post_page---top_nav_layout_nav-----------------------global_nav------------------)

![Image 1](https://miro.medium.com/v2/resize:fill:64:64/1*dmbNkD5D-u45r44go_cf0g.png)

# Infosec Advanced: Kerberoasting

[![Image 2: pkin1t](https://miro.medium.com/v2/resize:fill:64:64/1*QDBrSc3nRnyHgaIGrafdOA@2x.jpeg)](https://pkin1t.medium.com/?source=post_page---byline--185f1a466f1f---------------------------------------)

[pkin1t](https://pkin1t.medium.com/?source=post_page---byline--185f1a466f1f---------------------------------------)

4 min read

·

Just now

[](https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fvote%2Fp%2F185f1a466f1f&operation=register&redirect=https%3A%2F%2Fpkin1t.medium.com%2Finfosec-advanced-kerberoasting-185f1a466f1f&user=pkin1t&userId=366324860b3d&source=---header_actions--185f1a466f1f---------------------clap_footer------------------)

--

[](https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fbookmark%2Fp%2F185f1a466f1f&operation=register&redirect=https%3A%2F%2Fpkin1t.medium.com%2Finfosec-advanced-kerberoasting-185f1a466f1f&source=---header_actions--185f1a466f1f---------------------bookmark_footer------------------)

[Listen](https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2Fplans%3Fdimension%3Dpost_audio_button%26postId%3D185f1a466f1f&operation=register&redirect=https%3A%2F%2Fpkin1t.medium.com%2Finfosec-advanced-kerberoasting-185f1a466f1f&source=---header_actions--185f1a466f1f---------------------post_audio_button------------------)

Share

In a world where the majority of companies leverage Active Directory to handle authentication and access to resources in their environment, as the blue team it is important to understand the ways threat actors may attack. This article will go in-detail explaining what Kerberoasting is, how threat actors perform it and ways to mitigate against it.

* MITRE: [https://attack.mitre.org/techniques/T1558/003/](https://attack.mitre.org/techniques/T1558/003/)
* Windows 4769 Event (A Kerberos service ticket was requested): [https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4769](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4769)

## Sooo what is Kerberoasting?

Kerberoasting exploits how Kerberos handles authentication. In an AD environment, when a user wants to access a service (like SQL/IIS Server, etc), it requests what is called a **service ticket** (TGS or Ticket Granting Service ticket) from the domain controller.

A service ticket is essentially a temporary and encrypted credential used to access

Read full article → ← Back to Reads

Infosec Advanced: Kerberoasting

Key Takeaways

Full Article

Related Videos