Microsoft issues guidance on how best to hit back against Kerberoasting AD attacks

Kerberoasting is growing more effective, Microsoft warns

News By Sead Fadilpašić published 15 October 2024

Cybersecurity researchers from Microsoft have warned the effectiveness of a cyberattack method called Kerberoasting is growing.

To help businesses engage their defenses against this attack, the company published a new blog, explaining the methodology, the risks involved, and protection guidance.

According to Microsoft, the technique has grown more effective lately because hackers are increasingly using GPUs to accelerate password cracking.

GPUs making attacks potent

The blog, published by Microsoft’s Vice President of Enterprise and OS Security, David Weston, notes Kerberoasting is a cyberattack that targets the Kerberos authentication protocol, and which allows threat actors to steal Active Directory credentials.

Kerberos is a network authentication protocol that uses secret-key cryptography to allow secure authentication of users and services over unsecured networks, such as the internet. Active Directory, on the other hand, is a directory service developed for Windows domain networks, used to manage and authenticate users, devices, and services within an organization.

Kerberoasting is a post-exploitation attack technique where an attacker, after gaining access to a network, requests service tickets for accounts associated with services in Active Directory. These tickets are encrypted with the service account's NTLM hash. The attacker then extracts the ticket and attempts to break it offline and thus reveal the service account's password.

“Kerberoasting is a low-tech, high-impact attack,” Weston said. “There are many open-source tools which can be used to query potential target accounts, get service tickets to those accounts, and then use brute force cracking techniques to obtain the account password offline.”

Are you a pro? Subscribe to our newsletter

Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!

Contact me with news and offers from other Future brandsReceive email from us on behalf of our trusted partners or sponsors