Stop AS-REP Roasting: A Technical Prevention Checklist

Who Uses This Checklist

This checklist targets identity administrators and security engineers who manage Kerberos environments. You use it to verify that your directory services prevent offline password attacks. The process involves checking configuration flags, monitoring network traffic, and validating identity hygiene. Follow each item to ensure your infrastructure does not expose ticket data to attackers.

Identity Configuration Controls

These items address the root cause of the vulnerability. If an account allows ticket requests without proving its identity first, an attacker can capture the response and crack the password locally.

• Enforce Kerberos pre-authentication on all user accounts: This forces the server to encrypt part of the ticket request, preventing attackers from capturing usable data for offline cracking.
• Audit service accounts for pre-authentication requirements: Service accounts often inherit legacy settings that disable pre-authentication, creating high-value targets for credential harvesting.
• Disable pre-authentication only for specific legacy applications: If an application strictly requires it, isolate that account and monitor it closely, as it remains vulnerable to offline attacks.
• Review computer accounts for pre-authentication settings: Compromised machine accounts can be used to harvest tickets from other systems if pre-authentication is not enforced.

Network Detection and Monitoring

You cannot prevent an attack if you do not see the request. AS-REP roasting generates specific network traffic that differs from normal authentication flows. Monitoring this traffic allows you to detect reconnaissance before the attacker cracks the password.

• Monitor for KRB-AS-REP messages without pre-authentication: These packets indicate a request for a ticket from an account that does not require pre-authentication, signaling a potential roast attempt.
• Alert on high-frequency AS-REQ requests: A sudden spike in authentication requests often indicates an attacker enumerating accounts to find those with pre-authentication disabled.
• Log ticket request sources and timestamps: Correlating request sources helps you distinguish between legitimate legacy application behavior and malicious reconnaissance activity.
• Integrate logs with packet capture analysis tools: Deep inspection of network traffic reveals the structure of ticket requests, helping you identify subtle anomalies that log parsers might miss.

Password Policy and Hygiene

Even if you detect the request, a weak password makes cracking trivial. The complexity and length of the password determine how long an attacker needs to break the ticket data. Strong passwords increase the computational cost of the attack.

• Enforce complex password requirements for all accounts: Longer, complex passwords significantly increase the time required to crack hashed ticket data offline.
• Regularly rotate passwords for privileged accounts: Frequent rotation limits the window of opportunity for an attacker who has already captured ticket data but has not yet cracked the password.
• Disable unused accounts immediately: An inactive account with pre-authentication disabled is a silent vulnerability that provides attackers with a low-risk target for credential harvesting.
• Use password history settings to prevent reuse: Reusing weak passwords allows attackers to crack a new ticket using previously obtained hash data, bypassing the effort of new cracking attempts.

Access Control and Segmentation

Limiting what an attacker can do with a harvested ticket reduces the impact of the breach. Even if an attacker cracks a password, strict access controls prevent them from moving further into the network.

• Apply least privilege principles to all accounts: Restricting account permissions ensures that even if a password is cracked, the attacker gains limited access to sensitive resources.
• Segregate network zones for legacy systems: Isolating systems that require pre-authentication disabled prevents attackers from using those credentials to pivot to modern, secure systems.
• Monitor for lateral movement from compromised accounts: Detecting unusual login patterns helps you identify when an attacker is using cracked credentials to access additional systems.
• Implement just-in-time access for administrative tasks: Reducing the time an account has elevated privileges limits the exposure window if that account's credentials are compromised.

See also: Fix IOC Enrichment Errors: 6 Common Misunderstandings

Validation and Testing

Configuration settings can drift over time. Regular validation ensures that your protections remain effective. Testing your defenses helps you identify gaps before attackers exploit them.

• Conduct regular configuration audits: Automated scans check for accounts with pre-authentication disabled, ensuring that configuration drift does not create new vulnerabilities.
• Perform purple teaming exercises: Simulating AS-REP roasting attacks tests your detection capabilities and validates that your monitoring alerts trigger correctly.
• Review MITRE ATT&CK framework mappings: Aligning your defenses with known attack techniques ensures you cover all phases of the AS-REP roasting process, from reconnaissance to credential access.
• Validate threat intelligence feeds for relevant indicators: External data sources may provide early warning of new tools or techniques used to exploit pre-authentication weaknesses.

Incident Response Preparation

When detection occurs, your response speed matters. Having a plan in place ensures you can contain the threat and remediate the vulnerability quickly.

• Define response playbooks for AS-REP roasting: Clear steps for isolating affected accounts and resetting credentials reduce the time an attacker can exploit harvested tickets.
• Coordinate with LSASS credential theft prevention teams: AS-REP roasting often precedes more advanced attacks like LSASS memory dumping, so coordinating defenses improves overall security posture.
• Document and review incident outcomes: Post-incident reviews help you improve detection rules and configuration settings, reducing the likelihood of future exploitation.
• Train staff on recognizing AS-REP roasting indicators: Awareness ensures that analysts can quickly identify and respond to suspicious authentication traffic.

Key takeaways

• Pre-authentication must be enabled for every user and service account in the directory.
• Network monitoring should flag requests for AS-REP tickets that do not require pre-authentication.
• Regular audits detect misconfigurations before attackers harvest ticket data for offline cracking.

Frequently asked questions

What is AS-REP roasting?

AS-REP roasting is an attack where an attacker requests Kerberos tickets for accounts that do not require pre-authentication. The attacker captures the encrypted response and cracks the password offline without needing access to the domain controller.

How do I detect AS-REP roasting?

Monitor network traffic for KRB-AS-REP messages that do not include pre-authentication data. Look for spikes in AS-REQ requests from a single source, which indicate account enumeration.

Can strong passwords prevent AS-REP roasting?

Strong passwords do not prevent the initial ticket request, but they make cracking the captured ticket data computationally expensive. This buys time for detection and response.

Is AS-REP roasting still relevant?

Yes, AS-REP roasting remains a common initial access technique. Many organizations still have accounts with pre-authentication disabled due to legacy application requirements or configuration errors.

How this guide was produced: written by the NetSec Tribune editorial team with AI assistance, checked against the public references listed below, and reviewed when the facts change. See our editorial policy or report an error.