T1558.004 — AS-REP Roasting

Tactic: Credential Access · Platforms: Windows

Adversaries may reveal credentials of accounts that have disabled Kerberos preauthentication by Password Cracking Kerberos messages. Preauthentication offers protection against offline Password Cracking. When enabled, a user requesting access to a resource initiates communication with the Domain…

Sub-technique of Steal or Forge Kerberos Tickets (T1558).

Sigma detection rules (1)

T1558.004 Steal or Forge Kerberos Tickets: AS-REP Roasting

title: "T1558.004 Steal or Forge Kerberos Tickets: AS-REP Roasting"
id: c379d376-8b70-4fb2-8141-35e35f4ac25e
description: 'Detect AS-REP Roasting Attempts (T1558.004) via known offensive tooling command-line signatures (Rubeus asreproast module, Impacket GetNPUsers.py). (Retargeted to Sysmon EventID matching process_creation telemetry for reliable field coverage.) Tune using: PreAuthDisabledAccountsBaseline, TGTRequestThreshold, AllowedEncryptionTypes, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1558/004
author: Shahrukh Khan
date: 2026-04-11
license: MIT
tags:
  - attack.credential-access
  - attack.t1558.004

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection_rubeus:
    CommandLine|contains|all:
      - 'Rubeus'
      - 'asreproast'

  selection_impacket:
    CommandLine|contains: 'GetNPUsers'

  condition: 1 of selection_*

falsepositives:
  - Authorized red-team/penetration-testing tooling.

level: critical

Related sub-techniques

Explore