- Active Directory
- Red Team
Kerberoasting in 2026: still effective, more careful
Defenders have caught up to the loudest version of this attack. Here's the operator-grade version that still works.
By Hackerscorn Team · April 28, 2026 · 1 min read
Kerberoasting hasn't gone anywhere — the noise has. Detection rules now light up on the obvious tooling, but the underlying flaw is the same one it was five years ago: service accounts with weak passwords plus SPN-enabled equals TGS tickets you can crack offline.
Why it still works
The math hasn't moved. RC4 tickets crack on commodity GPUs in hours. AES-128/256 raises the bar but doesn't eliminate it. Most environments still have at least one SPN tied to a service account whose password was set in 2017 and never rotated.
What changed
Behavioral detections now key on volume and on tooling fingerprints. Pull every SPN ticket in two minutes with a tool that drops Mimikatz strings, and the SOC is alerted before you've started cracking.
Operator-grade version
- Request only the SPNs you have an actual hypothesis about
- Spread the requests across legitimate working hours
- Use a fresh, custom requester — not a flagged tool
- Crack offline on dedicated hardware, never on the target