T1558.004 AS-REP Roasting — Attack Simulation

Adversaries may reveal credentials of accounts that have disabled Kerberos preauthentication by Password Cracking Kerberos messages. Preauthentication offers protection against offline Password Cracking. When enabled, a user requesting access to a resource initiates communication with the Domain Controller (DC) by sending an Authentication Server Request (AS-REQ) message with a timestamp that is encrypted with the hash of their password. If and…

Technique description

At least one platform-compatible Atomic procedure is documented. Individual review, lab prerequisites, and validation remain required.

Official ATT&CK definition · Detection rules and anomaly models

Documented simulation candidates

Rubeus asreproast
windows automated powershell
Procedure 615bd568-2859-41b5-9aed-61f6a88e48dd; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.
WinPwn - PowerSharpPack - Kerberoasting Using Rubeus
windows automated powershell
Procedure 8c385f88-4d47-4c9a-814d-93d9deec8c71; elevation not declared required; cleanup not declared. Not executed or individually validated.
Get-DomainUser with PowerView
windows automated powershell
Procedure d6139549-7b72-4e48-9ea1-324fc9bdf88a; elevation not declared required; cleanup not declared. Not executed or individually validated.

Connected ecosystem references

Linked tags

enterprise cloud-hosted-endpoint onprem Windows credential-access isolated_authorized_lab procedure_review_required telemetry_configuration_required

can_simulate subtechnique source_mapped

Detection and collection

T1558.004 detection workspace

Attack tools

Rubeus · S1071

Existing research

Threat Matrix: knowledge routes, evidence and actor context

Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.