// KERBEROAST / AS-REP TRIAGE

Kerberoast Triage

Paste GetUserSPNs, Rubeus, or a raw $krb5tgs / $krb5asrep hash list — the tool auto-detects the format and ranks accounts by crackability × impact (RC4 vs AES, privilege, password age, delegation). Exports hashes for cracking (feeds the Hash Analyzer) and chainable edges. Client-side, nothing stored.

⚯

Paste roast output to prioritize

Ranks who to crack first, with the hashcat mode and the reasons

Blue Team — Detect & Remediate catch Kerberoasting with the $0 stack · ATT&CK T1558.003 SHOWHIDE▼

Detect it — Wazuh / $0 stack · LIVE-FIRE ✓ firing on real 4769

Fires on: Event 4769 (TGS requested) with ticket encryption type 0x17 (RC4) for a user SPN account → rule 100201 “Possible Kerberoasting” (T1558.003).
Why RC4 is the tell: roasting tools request the weakest cipher to crack offline. A modern AES-only estate makes the RC4 request itself anomalous.
Verify in Wazuh: rule.id:100201 or data.win.system.eventID:4769.

AUDITauditpol /set /subcategory:"Kerberos Service Ticket Operations" /success:enable (on by default).

WAZUHChain the base rule with <if_group>windows</if_group>, never <if_sid>60000</if_sid> (bug #36029) — the if_sid form silently never fires and wazuh-logtest falsely says it will.

FIXMove service accounts to gMSA or 25+ char passwords and force AES. Tier service accounts; alert on RC4 TGS for any non-machine SPN. The ranked list here tells you which weak SPNs to rotate first.