Detecting Kerberoasting Attacks
FreeProactively hunt for Kerberoasting threats in your environment.
Free · Opens the source repo
What Detecting Kerberoasting Attacks does
Detecting Kerberoasting Attacks is a specialized skill designed for cybersecurity professionals focused on identifying and mitigating credential access threats within Active Directory environments. This skill allows users to monitor for anomalous Kerberos Ticket Granting Service (TGS) requests, specifically Event ID 4769, which are often exploited by attackers attempting to crack service account passwords. By leveraging this skill, security teams can enhance their threat-hunting capabilities and respond more effectively to potential breaches.
The skill operates by utilizing data from various sources, including EDR platforms and SIEM systems, to detect patterns indicative of Kerberoasting attacks. Users are guided through a structured workflow that begins with formulating a hypothesis based on threat intelligence and progresses through data collection, analysis, and validation of findings. This systematic approach ensures that security teams can distinguish genuine threats from false positives, thereby improving the accuracy of their incident response efforts.
Ideal for organizations that have deployed comprehensive security monitoring solutions, this skill integrates well with existing tools such as CrowdStrike, Splunk, and Sysmon. It is particularly useful during proactive threat-hunting exercises, incident response scenarios, and security assessments. By employing this skill, teams can stay ahead of attackers who leverage Kerberos vulnerabilities, enhancing their overall security posture.
In summary, Detecting Kerberoasting Attacks is a vital tool for any security professional tasked with safeguarding Active Directory environments. It provides the necessary framework to detect, analyze, and respond to one of the more insidious forms of credential theft, ensuring that organizations can protect their sensitive information from unauthorized access.
When to use it
Use this skill when actively hunting for Kerberoasting indicators or when investigating alerts related to credential access techniques.
When not to use it
This skill may not be suitable for environments without a robust EDR or SIEM setup, as it relies heavily on telemetry and log data.
What you can build with it
Proactive Threat Hunting
Use this skill to actively search for signs of Kerberoasting in your network, enhancing your threat detection capabilities.
Incident Response
Deploy this skill during an incident response to analyze and scope potential Kerberoasting attacks based on alerts.
Security Assessments
Incorporate this skill into periodic security assessments to evaluate the effectiveness of your defenses against credential access techniques.
How to install Detecting Kerberoasting Attacks
View source1. Install with the skills CLI
npx skills add mukul975/anthropic-cybersecurity-skills/detecting-kerberoasting-attacks --agent claude-code2. Or install it manually
Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.
Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs
Inside SKILL.md
Written by mukul975Detecting Kerberoasting Attacks
When to Use
- When proactively hunting for indicators of detecting kerberoasting attacks in the environment
- After threat intelligence indicates active campaigns using these techniques
- During incident response to scope compromise related to these techniques
- When EDR or SIEM alerts trigger on related indicators
- During periodic security assessments and purple team exercises
Prerequisites
- EDR platform with process and network telemetry (CrowdStrike, MDE, SentinelOne)
- SIEM with relevant log data ingested (Splunk, Elastic, Sentinel)
- Sysmon deployed with comprehensive configuration
- Windows Security Event Log forwarding enabled
- Threat intelligence feeds for IOC correlation
Workflow
- Formulate Hypothesis: Define a testable hypothesis based on threat intelligence or ATT&CK gap analysis.
- Identify Data Sources: Determine which logs and telemetry are needed to validate or refute the hypothesis.
- Execute Queries: Run detection queries against SIEM and EDR platforms to collect relevant events.
- Analyze Results: Examine query results for anomalies, correlating across multiple data sources.
- Validate Findings: Distinguish true positives from false positives through contextual analysis.
- Correlate Activity: Link findings to broader attack chains and threat actor TTPs.
- Document and Report: Record findings, update detection rules, and recommend response actions.
Key Concepts
| Concept | Description |
|---|---|
| T1558.003 | Kerberoasting |
| T1558.004 | AS-REP Roasting |
| T1558.001 | Golden Ticket |
Tools & Systems
| Tool | Purpose |
|---|---|
| CrowdStrike Falcon | EDR telemetry and threat detection |
| Microsoft Defender for Endpoint | Advanced hunting with KQL |
| Splunk Enterprise | SIEM log analysis with SPL queries |
| Elastic Security | Detection rules and investigation timeline |
| Sysmon | Detailed Windows event monitoring |
| Velociraptor | Endpoint artifact collection and hunting |
| Sigma Rules | Cross-platform detection rule format |
Common Scenarios
- Scenario 1: Rubeus kerberoast targeting all SPN accounts
- Scenario 2: GetUserSPNs.py from Impacket requesting RC4 tickets
- Scenario 3: Targeted kerberoast against high-privilege service accounts
- Scenario 4: AS-REP roasting accounts without pre-authentication
Output Format
Hunt ID: TH-DETECT-[DATE]-[SEQ]
Technique: T1558.003
Host: [Hostname]
User: [Account context]
Evidence: [Log entries, process trees, network data]
Risk Level: [Critical/High/Medium/Low]
Confidence: [High/Medium/Low]
Recommended Action: [Containment, investigation, monitoring]
Frequently asked questions about Detecting Kerberoasting Attacks
Similar skills
Asset Criticality Scoring for Vulns
Prioritize vulnerabilities based on asset criticality.
Performing Alert Triage with Elastic SIEM
Streamline alert triage processes in Elastic Security.
Active Directory Vulnerability Assessment
Secure your Active Directory with comprehensive assessments.
Active Directory Investigation
Streamline your Active Directory compromise investigations.
Parsing Artifacts with Eric Zimmerman Tools
Efficiently parse Windows forensic artifacts for analysis.
Operationalizing MISP Threat Feeds
Enhance threat detection with curated MISP feeds.