Authentication Server Response (AS-REP) Roasting enables attackers to request encrypted authentication responses for accounts in Active Directory that have Kerberos pre-authentication disabled. AS-REP Roasting is one of the Active Directory threats that cybersecurity agencies in the Five Eyes alliance warn about in the recent report, Detecting and Mitigating Active Directory Compromises.
What is AS-REP Roasting?
The key tactic in an AS-REP Roasting attack revolves around having Kerberos pre-authentication disabled. In that scenario, an attacker doesn’t need the user’s password to get an authentication response (Figure 1). Once the attacker has the response, they can attempt to crack it offline to retrieve the user’s plaintext password.
How can you defend against AP-REP Roasting?
Defenders can use the free Purple Knight tool to identify Active Directory accounts that have Kerberos pre-authentication disabled (Figure 2). After identifying these vulnerable accounts, defenders should determine whether pre-authentication can be enabled to reduce the risk of attacks like AS-REP Roasting.
Purple Knight can provide a list of the accounts that have Kerberos pre-authentication disabled (Figure 3). The next step is to assess whether each account genuinely requires this setting to be disabled.
In this example, I ran a PowerShell script to process a list of the user accounts that have Kerberos pre-authentication disabled, automatically enabling pre-authentication to mitigate the threat of AS-REP Roasting (Figure 4). In practice, you should always determine why pre-authentication is disabled and verify that it can be enabled for each account before making changes.
Note the increase in security score after enabling Kerberos pre-authentication (Figure 5).
Note that Purple Knight provides a point-in-time snapshot of potential vulnerabilities. For ongoing defense, Semperis Directory Services Protector (DSP) features a security indicator that continuously monitors for users with disabled Kerberos pre-authentication, which is necessary for an attacker to carry out an AS-REP Roasting attack (Figure 6). By monitoring unexpected accounts with disabled pre-authentication, defenders can proactively prevent potential AS-REP Roasting attempts.
How can you detect an AS-REP Roasting attack?
Defenders can detect AS-REP Roasting by monitoring event ID 4768 (Figure 7). Look for a Pre-Authentication Type of 0, meaning disabled. Also watch for a Service Name of krbtgt; Kerberos manages authentication in Active Directory. Lastly, look for a Ticket Encryption Type of 0x17 (RC4), which indicates the use of a weaker encryption method.
Threat actor profiles
The following threat actors have been known to launch AS-REP Roasting attacks in the wild.
- BlackSuit1
- Diavol (MITRE ATT&CK Software S0659)2
AS-REP Roasting tools
The following public tools and scripts, which are available on github.com, can be used to perform an AS-REP Roasting attack and have been observed in use during real-world incidents.
- GhostPack/Rubeus
- HarmJ0y/ASREPRoast
AS-REP Roasting threat overview
ATT&CK Tactic: Credential Access
On August 26, 2024, The DFIR Report revealed that the BlackSuit ransomware gang used AS-REP Roasting in its attacks. The group targeted accounts with Kerberos pre-authentication disabled to capture and crack authentication responses, which provided access to user passwords.3
On December 13, 2021, The DFIR Report detailed how the Diavol ransomware gang used AS-REP Roasting in its attacks. The gang targeted accounts with Kerberos pre-authentication disabled, capturing encrypted authentication responses. The group then cracked those responses offline to retrieve plaintext passwords.4
Semperis snapshot
AS-REP Roasting remains a relevant technique for attackers, targeting Active Directory accounts with Kerberos pre-authentication disabled. By cracking encrypted authentication responses offline, attackers can escalate privileges and gain access to higher-privileged accounts. To defend against AS-REP Roasting, organizations must ensure that Kerberos pre-authentication is enabled for all accounts, apply strong password policies, and regularly monitor for abnormal authentication behavior.
Additional resources
Endnotes
