TA0006 · CREDENTIAL ACCESS
AS-REP Roasting
Adversaries may reveal credentials of accounts that have disabled Kerberos preauthentication by Password Cracking Kerberos messages. Preauthentication offers protection against offline Password Cracking.
Detect it with
Enable Audit Kerberos Service Ticket Operations to log Kerberos TGS service ticket requests.
Why it matters on shift
AS-REP Roasting is one of the concrete ways adversaries achieve credential access. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After credential access, the next tactic is usually Discovery. Search your telemetry for the transition before closing the ticket.
Kill-chain context