Kerberoasting & RC4 Tickets: Defender for Identity Hunting — Akuity SOC

In internal Active Directory compromise scenarios, the Kerberoasting technique (MITRE ATT&CK T1558.003) remains one of the most effective methods for privilege escalation. Requiring zero domain administrative privileges, this attack enables any standard domain user to request Kerberos service tickets (TGS-REQ) from the Key Distribution Center (KDC) for accounts with a registered Service Principal Name (SPN). The attacker's objective is clear: retrieve an encrypted ticket portion and perform offline brute-force cracking to extract the plaintext service account password.

Attack Anatomy: Forcing the RC4 Encryption Downgrade

Modern Kerberos implementations default to robust ciphers such as AES-256 (encryption type 0x12). However, during an optimized Kerberoasting operation orchestrated with offensive frameworks like Rubeus or Impacket, the adversary explicitly requests the legacy cipher RC4-HMAC-MD5 (type 0x17). The computational gain is massive: cracking an NTLM hash derived from an RC4 ticket in hashcat is orders of magnitude faster than breaking an AES-256 derived key that requires computationally expensive PBKDF2-HMAC-SHA1 rounds.

Once issued, the adversary captures the TGS-REP payload, exfiltrates the cryptographic material, and cracks the hash entirely offline without interacting further with the target service host, completely bypassing standard host-level authentication logs.

Telemetry Blind Spots in Defender for Identity

While Defender for Identity deeply inspects domain controller RPC and Kerberos traffic, default out-of-the-box alerts typically depend on broad statistical thresholds or recognizable tool signatures. Sophisticated threat actors easily evade these triggers using low-and-slow tactics—distributing TGS requests over extended time windows or querying single high-value targets outside standard business hours. Furthermore, legacy enterprise environments often contain legitimate service accounts still configured for RC4, which can introduce noise.

To reliably isolate malicious ticket requests without drowning in machine-account noise, security analysts must leverage raw telemetry within IdentityLogonEvents using Advanced Hunting (KQL).

KQL Query: Pinpointing RC4 TGS Request Bursts

The following query identifies Kerberos service ticket requests encrypted with RC4, filters out standard machine accounts, and aggregates targets to detect anomalous SPN enumeration bursts:

IdentityLogonEvents
| where Timestamp > ago(24h) and Protocol =~ "Kerberos"
| extend EncryptionType = tostring(parse_json(AdditionalFields).TicketEncryptionType),
         TargetSpn = tostring(parse_json(AdditionalFields).Spn)
| where EncryptionType in ("0x17", "RC4-HMAC-MD5", "RC4")
| where not(AccountName endswith "$") and not(TargetSpn startswith "HOST/")
| where TargetAccountDisplayName !endswith "$" and TargetAccountDisplayName != "krbtgt"
| summarize 
    RequestedSpnCount = dcount(TargetSpn),
    SpnList = make_set(TargetSpn, 10),
    TargetAccounts = make_set(TargetAccountDisplayName, 10),
    FirstSeen = min(Timestamp),
    LastSeen = max(Timestamp)
    by AccountName, AccountDomain, IPAddress
| where RequestedSpnCount >= 3
| extend DurationSeconds = datetime_diff('second', LastSeen, FirstSeen)
| project FirstSeen, LastSeen, DurationSeconds, AccountName, AccountDomain, IPAddress, RequestedSpnCount, SpnList, TargetAccounts
| sort by RequestedSpnCount desc

Coordinated SOAR Remediation with Akuity SOC

When an active Kerberoasting operation is flagged, speed is critical before the target ticket hash is cracked offline. Akuity SOC transforms detection telemetry into immediate remediation actions:

• Air-Gapped In-App Decoding: Akuity SOC's in-app AI assistant correlates RC4 TGS-REQ bursts and isolates targeted service accounts in real time, without ever exporting hashes or ASN.1 structures to third-party web tooling.
• One-Click Coordinated SOAR Response: Instant execution of confirmUserCompromised() and revokeSessions() on the requesting identity in Microsoft Entra ID directly from the incident evidence board, combined with isolateDevice() via Defender for Endpoint to isolate the weaponized workstation.
• Certified Zero-Trust Governance: Secure administrative privilege escalation protected by mandatory MFA AAL2 validation, recorded in an immutable audit ledger meeting NIS 2 and SOC 2 Type II compliance standards.

Technical Mini-FAQ

Why do attackers prefer service accounts over standard user accounts during post-exploitation?

Service accounts frequently possess elevated privileges across enterprise infrastructure (e.g., local administrative rights, direct SQL sysadmin roles) while rarely enforcing password rotation policies to prevent production downtime. Additionally, their SPNs can be queried by any domain authenticated identity.

What is the definitive defense against Kerberoasting in Active Directory?

The definitive long-term architectural defense involves migrating user-based service accounts to Group Managed Service Accounts (gMSA), which employ complex 128-character automatically rotated passwords, and strictly enforcing AES-128 and AES-256 while disabling RC4 via domain-level Kerberos Group Policies.