Kerberoasting Explained

This post focuses on obtaining domain administrative privileges from a local administrator or domain user account. Once the initial steps have been taken to obtain local administrative access on a Windows operating system, the natural next steps are to gain domain user and domain administrative privileges.

Semperis argues AI-driven attacks are outpacing identity teams as machine identities outnumber human ones 10:1, and urges building organization-wide cyber resilience around hybrid identity protection before the next crisis.

Semperis unpacks the Five Eyes' June 2026 warning on AI-accelerated threats, urging boards to treat cyber resilience as core business risk and validate identity recovery before attackers do.

Why Microsoft is retiring RC4 encryption to blunt Kerberoasting, which applications depend on it, and how to audit your AD environment to find RC4-dependent accounts before enforcement bites.

Group Policy abuse lets attackers with GPO write access push malware as SYSTEM, disable security settings, or plant backdoors. The post covers a SharpGPOAbuse scenario and Purple Knight detection.

AS-REP Roasting targets accounts with Kerberos pre-authentication disabled: attackers request an encrypted response and crack it offline. The post shows finding and fixing them with Purple Knight.