Rubeus kerberoast

Rubeus.exe kerberoast /outfile:hashes.txt

Requests service tickets (TGS) for accounts with SPNs and extracts hashes for offline cracking.

Run this when you already have an authenticated domain account on a Windows host. It is the first post-compromise step to obtain hashes of service accounts. Rubeus is faster than GetUserSPNs.py because it authenticates with the TGT ticket of the current session, avoiding extra authentication.

Avoid Rubeus if the EDR has signatures for the binary (Defender ATP flags Rubeus as a hacktool). If the target has 25+ random character passwords, offline cracking may be infeasible. In domains with hardened Kerberos preauthentication, you will not obtain TGS if accounts have PAC enabled.