Detection of Kerberoasting via Newly Observed RC4 Kerberos Requests

This detection intelligence addresses the risk of Kerberoasting, a technique where attackers request Kerberos service tickets for service accounts with Service Principal Names (SPNs) registered. By requesting these tickets using the weak RC4-HMAC encryption type (0x17), attackers can capture the ticket and perform offline brute-force attacks to recover the cleartext password of the service account. This detection focuses on identifying anomalous behavior by monitoring for successful ticket requests (Event ID 4769) that involve a requester-to-service relationship not observed within the previous seven days. This approach reduces noise from legitimate, established traffic while highlighting potential reconnaissance or credential harvesting activities by an adversary.

Attack Chain

1. Attacker performs internal reconnaissance to identify user accounts with SPNs configured.
2. Attacker interacts with the Domain Controller to request a Kerberos service ticket for a target service account.
3. Attacker forces the use of RC4-HMAC (0x17) encryption during the TGS-REQ (Ticket Granting Service Request) phase.
4. The Domain Controller issues a service ticket encrypted with the service account password hash.
5. Attacker captures the service ticket from memory or by intercepting the authentication response.
6. Attacker extracts the encrypted ticket portion containing the service account hash.
7. Attacker performs offline cracking of the captured hash to obtain the account's plaintext password.
8. Attacker uses the compromised credentials to escalate privileges or move laterally within the domain.

Impact

Successful Kerberoasting allows attackers to obtain credentials for highly privileged service accounts, which are often not subject to regular password rotation policies. This often leads to full Active Directory domain compromise, lateral movement to sensitive servers, and potential long-term persistence within the target environment.

Recommendation

1. Enable "Audit Kerberos Service Ticket Operations" via Group Policy to ensure Event ID 4769 is generated by domain controllers.
2. Implement the provided Sigma rule (or equivalent SIEM logic) to alert on RC4-encrypted service ticket requests that represent new requester-to-service relationships.
3. Prioritize service accounts for conversion from RC4-HMAC to AES-128/256 encryption.
4. Audit accounts with SPNs to identify and disable unnecessary service accounts or those with weak password policies.