Kerberos Credential Harvesting Response (Kerberoasting / AS-REP / Pass-the-Ticket)
When a DR-1/DR-2/DR-6 alert indicates Kerberoasting, AS-REP Roasting, or Pass-the-Ticket, identifies exposed service/user accounts and closes the threat surface through controlled rotation; krbtgt is not touched.
Prepare
6 steps- Verify Kerberos auditing
Confirm that Event ID 4768 (AS-REQ/AS-REP) and 4769 (TGS-REQ) auditing is enabled on DCs, and that Sysmon EID 1 (ProcessCreate) and EID 10 (ProcessAccess) events are being collected
- SPN and service account inventory
Document the current SPN list and high-privilege service accounts (including pwdLastSet, group membership) as a baseline; without an inventory, impact analysis in the Eradicate step is not possible
- RC4 dependency inventory
Collect KDCSVC EID 201–209 output on DCs under CVE-2026-20833 to document accounts and services dependent on RC4; this is a planned migration input, not an incident-time action
- Deploy honey-SPN
Any 4769 event for trap SPNs with no legitimate use generates a high-confidence signal; if deployed, verify that the DR-6 rule is live and calibrated
- Define escalation chain
Document the SOC L1 → L2/IR → AD administrator → IR Lead chain; containment decisions cannot be made by L1 alone
- Decision gate: PB-A or PB-B?
Credential harvesting only (Kerberoasting/AS-REP/PtT, no DCSync/DA/DC evidence) → this playbook (PB-A); DCSync, NTDS, DA, or Golden Ticket evidence → switch to the Kerberos Domain Compromise Playbook (PB-B)