Explain Kerberoasting attack with full chain.

Kerberoasting — extract service account password hashes from AD. Chain: (1) As any AD user, query domain for SPNs (Service Principal Names) — every service-using account has SPN. (2) Request Kerberos service ticket (TGS) for each SPN — TGS is encrypted with service account's NTLM hash. (3) Extract TGS using Rubeus or impacket-GetUserSPNs. (4) Crack offline with hashcat (-m 13100) using rockyou.txt or custom wordlists. (5) Service accounts often have weak/stale passwords + are admins → recover password → privilege escalation. Defence: long random service account passwords (24+ chars), Group Managed Service Accounts (gMSA), AES-only Kerberos.