Understanding & Detecting AS-REP Roasting (T1558.004) in Active Directory

Overview AS-REP Roasting targets user accounts in Active Directory that have the Do not require Kerberos preauthentication (`UF_DONT_REQUIRE_PREAUTH`) property enabled. When pre-authentication is disabled, an attacker can request an Authentication Server Response (AS-REP) for that user from the Key Distribution Center (KDC) without knowing the user's password.

Because a portion of the AS-REP message is encrypted with the user's NTLM password hash, it can be extracted and cracked offline using Hashcat (mode 18200).

Offensive Emulation (Red Perspective) From an unauthenticated or domain-joined foothold, accounts with pre-authentication disabled can be enumerated via LDAP filter `(userAccountControl:1.2.840.113556.1.4.803:=4194304)` or requested directly:

bash

# Using Impacket GetNPUsers
impacket-GetNPUsers corp.local/ -usersfile users.txt -format hashcat -outputfile asrep.hashes -dc-ip 10.10.10.5

# Offline cracking with Hashcat
hashcat -m 18200 asrep.hashes /usr/share/wordlists/rockyou.txt

Detection Strategy (Blue Perspective) When an AS-REP request is processed by a Domain Controller, Windows logs Security Event ID 4768 (A Kerberos authentication ticket (TGT) was requested).

Key indicators to filter in SIEM:

Event ID: 4768
Pre-Authentication Type: 0 (Logon without Pre-Authentication)
Ticket Encryption Type: 0x17 (RC4-HMAC)
Result Code: 0x0 (Success)

spl

index=wineventlog EventCode=4768 Pre_Auth_Type=0 Ticket_Encryption_Type=0x17 Status=0x0
| stats count values(Client_Address) as Source_IPs by Account_Name, dest
| where count > 0

Remediation & Purple Takeaways 1. Audit User Account Control flags: Regularly query Active Directory for any account with `DoesNotRequirePreAuth` set to `True` and re-enable Kerberos pre-authentication immediately. 2. Disable RC4 where possible: Enforce AES-128/AES-256 encryption for Kerberos tickets across domain policy. 3. Strong password policy: Ensure accounts that require legacy compatibility use 25+ character random passwords.

Offensive Emulation (Red Perspective) From an unauthenticated or domain-joined foothold, accounts with pre-authentication disabled can be enumerated via LDAP filter `(userAccountControl:1.2.840.113556.1.4.803:=4194304)` or requested directly:

Detection Strategy (Blue Perspective) When an AS-REP request is processed by a Domain Controller, Windows logs **Security Event ID 4768** (*A Kerberos authentication ticket (TGT) was requested*).

Detection Strategy (Blue Perspective) When an AS-REP request is processed by a Domain Controller, Windows logs Security Event ID 4768 (A Kerberos authentication ticket (TGT) was requested).