AS-REP Roasting

Subtechnique · ATTACK:enterprise:T1558.004

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1558.004",
  "title": "AS-REP Roasting",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1558/004",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--3986e7fd-a8e9-4ecb-bfc6-55920855912b",
  "external_id": "T1558.004",
  "domain": "enterprise",
  "created": "2020-08-24T13:43:00.028Z",
  "modified": "2025-10-24T17:48:39.884Z",
  "version": "1.2",
  "aliases": [

  ],
  "tactics": [
    "credential-access"
  ],
  "source_references": [
    {
      "source_name": "Microsoft Detecting Kerberoasting Feb 2018",
      "url": "https://blogs.technet.microsoft.com/motiba/2018/02/23/detecting-kerberoasting-activity-using-azure-security-center/"
    },
    {
      "source_name": "Harmj0y Roasting AS-REPs Jan 2017",
      "url": "https://blog.harmj0y.net/activedirectory/roasting-as-reps/"
    },
    {
      "source_name": "Stealthbits Cracking AS-REP Roasting Jun 2019",
      "url": "https://blog.stealthbits.com/cracking-active-directory-passwords-with-as-rep-roasting/"
    },
    {
      "source_name": "SANS Attacking Kerberos Nov 2014",
      "url": "https://redsiege.com/kerberoast-slides"
    },
    {
      "source_name": "AdSecurity Cracking Kerberos Dec 2015",
      "url": "https://adsecurity.org/?p=2293"
    },
    {
      "source_name": "Microsoft 4768 TGT 2017",
      "url": "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4768"
    },
    {
      "source_name": "Microsoft Kerberos Preauth 2014",
      "url": "https://social.technet.microsoft.com/wiki/contents/articles/23559.kerberos-pre-authentication-why-it-should-not-be-disabled.aspx"
    }
  ]
}

Explicit source assertions (5)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.