TACTIC: CREDENTIAL ACCESS
Kerberoasting (T1558.003): real cases
MITRE Definition ↗ Adversaries request Kerberos service tickets for accounts with Service Principal Names and crack hashes offline.
Key Facts
Technique ID
T1558.003
Credential Access
Mapped Cases
1
Primary sources
Related Laws
4
Criminal statutes
- ATT&CK Technique Identifier: T1558.003.
- Tactical Phase: Credential Access.
- Substantiated in 1 primary court prosecution cases.
- Every associated case includes verbatim evidentiary excerpts from indictments or sworn affidavits.
Verified Evidentiary Case Records
U.S. v. Khoroshev et al. (LockBit Ransomware Operation)
charged 2024-05-07
Primary Source Evidence Excerpt: CISA Advisory AA23-165A Appendix
"LockBit affiliates executed Kerberoasting scripts against local Active Directory servers to request service tickets and extract Kerberos hashes for offline cracking."
U.S. District Court for the District of New Jersey
View full case dossier →
Commonly Charged Criminal Statutes
18 U.S.C. § 1030(a)(2)
Unauthorized Access to Obtain Protected Information
Prohibits intentionally accessing a computer without authorization or exceeding authorized access to obtain financial, government, or protected computer records.
18 U.S.C. § 1030(a)(5)(A)
Intentional Damage to a Protected Computer
Prohibits knowingly causing the transmission of a program, information, code, or command that intentionally causes damage without authorization to a protected computer.
18 U.S.C. § 1030(a)(7)
Extortion in Connection with Computers
Prohibits transmitting in interstate or foreign commerce threats to cause damage to a protected computer or obtain confidential information with intent to extort money or value.
18 U.S.C. § 1030(b)
Conspiracy to Commit Computer Fraud
Punishes any person who conspires to commit or attempts to commit any computer fraud offense under section 1030.