Kerberoasting Attack Chain

You are a penetration tester with a valid low-privilege domain account.

Walk through the complete Kerberoasting attack chain from discovery to cracking:

**Step 1 — SPN Discovery**
- How do you enumerate service principal names without triggering LDAP alerts?
- Which account types are most commonly Kerberoastable in real environments?
- How do you differentiate machine accounts from user accounts in SPN results?

**Step 2 — Ticket Request**
- What happens at the Kerberos protocol level when you request a service ticket?
- Why can any authenticated domain user request tickets for any SPN?
- What encryption types make tickets crackable vs uncrackable?

**Step 3 — Offline Cracking**
- What wordlist and rule strategies work best against service account passwords?
- How do you prioritize which hashes to crack first?
- What password patterns are service accounts typically set with in enterprise environments?

**Step 4 — Post-Crack Actions**
- Once you have plaintext credentials, what is your next logical step?
- How do you verify the account's actual access without generating noise?

Constraints:
- Authorized penetration test only
- Document the detection opportunities defenders have at each step

Output:
- Step-by-step attack chain
- Defender detection opportunities per step
- Mitigation recommendations (for reporting)