Before you can attack an Active Directory environment, you need to know who's in it. Pre-authentication enumeration is the process of building a confirmed user list without credentials, without completing an authentication attempt, and without triggering account lockouts. It exploits Kerberos protocol behavior — not an account misconfiguration — which means it works against any domain regardless of patch level.
This module covers the AS-REQ mechanic that makes it possible, the two tools you'll run on every engagement, and the detection signatures defenders should be tuning.
Pre-auth enumeration and AS-REP roasting are related but distinct. Enumeration builds a user list by exploiting the KDC's differential response to valid vs. invalid usernames. AS-REP roasting then targets a subset of those users — accounts with Kerberos pre-authentication disabled — to request crackable ticket blobs. Enumeration always comes first. This module covers enumeration; AS-REP roasting is covered in the next module.
When a client wants a Kerberos ticket, it sends an AS-REQ — Authentication Service Request — to the Domain Controller's KDC service on port 88. That message contains the target username and, if pre-authentication is enabled on the account, an encrypted timestamp proving the client knows the password.
Here is the behavior that makes enumeration possible: the KDC returns a different error code depending on whether the username exists in the directory.
An attacker sending AS-REQ messages with candidate usernames can read those response codes to determine which accounts exist. Because no authentication is ever completed — only the initial request is sent — the failed login counter never increments. No lockout. No password attempt. No credential required.
This is Kerberos protocol behavior, not a misconfiguration. The KDC must differentiate between non-existent users and users who need to provide pre-authentication — otherwise legitimate clients couldn't know which flow to follow. There is no patch that eliminates this differential. Defenders can detect it; they cannot prevent it.
Kerbrute sends AS-REQ messages in parallel and interprets the KDC response codes to confirm valid usernames. It is purpose-built for this technique, fast, and produces clean output. No special privileges required — it runs from any host with line-of-sight to port 88.
Your wordlist quality determines your coverage. Build from LinkedIn OSINT (naming convention inference — first.last, flast, f.last), breach data correlated to the target domain, and common service account patterns (svc_, sql_, backup_, admin_). A generic SecLists wordlist will miss 60% of real accounts in a tight environment. The AS-REP roastable flag in the output (** AS-REP roastable **) means Kerbrute caught a 0x00 response — save that username immediately, it's your first offline crack target.
While Kerbrute works against Kerberos, NetExec covers the SMB attack surface. A null session is an unauthenticated SMB connection using empty credentials. Older Windows configurations — and some modern ones with legacy settings — accept null sessions and expose share listings, user lists, and session data.
A writable share like IT_Scripts is a significant pivot opportunity. If Group Policy or a scheduled task references that share, dropping a payload there converts unauthenticated share access into code execution on any host that picks it up. Verify before writing anything: check for .bat, .ps1, or .vbs files already in the share — their presence confirms automated pickup. In a strict-lockout environment this path to lateral movement is safer than any password spray.
| Event ID | Source | Trigger | Detection Condition |
|---|---|---|---|
| 4768 | Security log (DC) | Every AS-REQ to the KDC | Volume ≥50 from single source IP in <60s. Filter on Failure Code 0x6 (user not found) for pure enumeration detection. |
| 4768 | Security log (DC) | AS-REP roastable account hit | Result Code 0x0 + Pre-Authentication Type 0. Immediate alert — no legitimate reason for pre-auth to be disabled on most accounts. |
| 4624 | Security log (target) | Null session SMB logon | Logon Type 3 + Account Name empty or ANONYMOUS LOGON. Baseline your environment — some legacy systems generate these legitimately. |
| 5140 | Security log (target) | Network share access | Alert on access to non-standard shares (anything outside NETLOGON/SYSVOL/IPC$) from unauthenticated sessions or unexpected source IPs. |
| 5145 | Security log (target) | Share object access check | More granular than 5140 — logs individual file/directory access within shares. High volume in short window = automated tooling. |
Raw 4768 volume without the 0x6 filter will generate significant noise in large environments — every failed logon from a misconfigured service account hits this event. Build the query as: EventID=4768 AND FailureCode=0x6 AND SourceIP=same_ip AND count > 20 within 60s. That specificity drops false positives dramatically while catching real enumeration runs.
You have a confirmed user list and flagged accounts with pre-authentication disabled. AS-REP roasting requests their encrypted ticket blobs from the KDC and cracks them offline with Hashcat — no lockout risk, no special privileges required. This module covers the full workflow: GetNPUsers, hash extraction, Hashcat mode 18200, and what to do when you crack a service account.
AS-REP Roasting →