What Kerberoasting is
Kerberoasting is a technique where an attacker requests Kerberos service tickets and then cracks service-account passwords offline.
It is dangerous because it needs no admin rights and leaves few noisy traces.
How to spot it
a spike in TGS requests for SPN accounts
weak service-account passwords
anomalous off-hours activity