Kerberoasting
Subtechnique · ATTACK:enterprise:T1558.003
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1558.003",
"title": "Kerberoasting",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1558/003",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--f2877f7f-9a4c-4251-879f-1224e3006bee",
"external_id": "T1558.003",
"domain": "enterprise",
"created": "2020-02-11T18:43:38.588Z",
"modified": "2025-10-24T17:49:36.038Z",
"version": "1.3",
"aliases": [
],
"tactics": [
"credential-access"
],
"source_references": [
{
"source_name": "Microsoft Detecting Kerberoasting Feb 2018",
"url": "https://blogs.technet.microsoft.com/motiba/2018/02/23/detecting-kerberoasting-activity-using-azure-security-center/"
},
{
"source_name": "Empire InvokeKerberoast Oct 2016",
"url": "https://github.com/EmpireProject/Empire/blob/master/data/module_source/credentials/Invoke-Kerberoast.ps1"
},
{
"source_name": "SANS Attacking Kerberos Nov 2014",
"url": "https://redsiege.com/kerberoast-slides"
},
{
"source_name": "AdSecurity Cracking Kerberos Dec 2015",
"url": "https://adsecurity.org/?p=2293"
},
{
"source_name": "Microsoft SetSPN",
"url": "https://social.technet.microsoft.com/wiki/contents/articles/717.service-principal-names-spns-setspn-syntax-setspn-exe.aspx"
},
{
"source_name": "Microsoft SPN",
"url": "https://msdn.microsoft.com/library/ms677949.aspx"
},
{
"source_name": "Harmj0y Kerberoast Nov 2016",
"url": "https://blog.harmj0y.net/powershell/kerberoasting-without-mimikatz/"
}
]
}Explicit source assertions (17)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S1071 → uses → ATTACK:enterprise:T1558.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0253908e-87d0-4804-994c-2ab58c3d3111
GitHub Rubeus March 2023ATTACK:enterprise:M1027 → mitigates → ATTACK:enterprise:T1558.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--487a6f8b-669d-4d72-8be8-38a48af51308
AdSecurity Cracking Kerberos Dec 2015ATTACK:enterprise:S0357 → uses → ATTACK:enterprise:T1558.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5d4113cb-f652-4214-9585-388422528960
Impacket ToolsATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1558.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5f1cf52c-f565-4325-9d4f-4a961c642a0f
Github PowerShell EmpireATTACK:enterprise:C0049 → uses → ATTACK:enterprise:T1558.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6181f0b4-be28-4612-b45d-b94c851ebb56
CISA Leviathan 2024ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1558.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--72b30ddb-137c-4799-bacd-ab17aa2d01fc
DHS/CISA Ransomware Targeting Healthcare October 2020 · FireEye KEGTAP SINGLEMALT October 2020 · Mandiant FIN12 Oct 2021 · DFIR Ryuk 2 Hour Speed Run November 2020 · DFIR Ryuk's Return October 2020ATTACK:enterprise:C0014 → uses → ATTACK:enterprise:T1558.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--827cbddc-3e19-4aff-a27a-5cce63812d44
FoxIT Wocao December 2019ATTACK:enterprise:S0692 → uses → ATTACK:enterprise:T1558.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--91dc0049-df2a-4dc0-b6b4-863a9a733c7a
GitHub SILENTTRINITY Modules July 2019ATTACK:enterprise:T1558.003 → subtechnique-of → ATTACK:enterprise:T1558
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--944b9cc3-95c7-4e0d-8b62-576aa6cf7217
ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1558.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--aa84d43a-4f79-485c-95ea-a375d5f52838
Microsoft Deep Dive Solorigate January 2021ATTACK:enterprise:S0194 → uses → ATTACK:enterprise:T1558.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--aaa0e944-7158-4baa-b45b-c687f7b161b5
Harmj0y Kerberoast Nov 2016 · PowerSploit Invoke KerberoastATTACK:enterprise:M1041 → mitigates → ATTACK:enterprise:T1558.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c2bc4c63-486f-4c92-9eaa-ece8226ec70c
AdSecurity Cracking Kerberos Dec 2015ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1558.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cb54d317-f787-4d30-a356-abf198a3923a
Mandiant_UNC1549TTPsTools_Nov2025ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1558.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--df3c2022-f649-45f5-a987-5ba7a766a058
Mandiant FIN7 Apr 2022 · CrowdStrike Carbon Spider August 2021ATTACK:enterprise:G0119 → uses → ATTACK:enterprise:T1558.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e9ebd661-1095-4638-8231-1ebccf520069
Mandiant_UNC2165ATTACK:enterprise:S1063 → uses → ATTACK:enterprise:T1558.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fb20c1f3-aa1e-49f3-9793-e07e0d430f5d
Palo Alto Brute Ratel July 2022ATTACK:enterprise:M1026 → mitigates → ATTACK:enterprise:T1558.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fb2122bc-cf7a-4e0b-8dcb-5ab27e37ea13
AdSecurity Cracking Kerberos Dec 2015