Kerberoasting is an Active Directory attack technique that abuses Kerberos service tickets. An attacker with low-level domain access requests tickets for service accounts, then extracts the ticket data and tries to crack the underlying password offline. The goal is not to break Kerberos itself, but to recover a service account credential that can be reused for broader access.
This matters because service accounts often have elevated privileges, long-lived passwords, and weaker management than interactive user accounts. If the password is weak or reused, a cracked service account can become a stepping stone to more sensitive systems, delegation paths, or privileged groups. Defenders reduce the risk by using strong random passwords, managed service accounts, least privilege, and monitoring for unusual ticket requests. Kerberoasting is a common AD abuse pattern because it turns normal authentication traffic into a password-recovery opportunity.