Skip to content
Threat Feed
Subscribe
medium advisory

Kerberoasting Activity Identification

This brief provides a detection baseline for identifying potential Kerberoasting activity by monitoring for RC4-encrypted service ticket requests in Windows security logs.

Triage facts

Revision 1
Applicability
Windows
Evidence
Unknown
Severity
Medium
Action
Elevated
Sources
4 public sources
Freshness
Revision 1Nov 10, 06:40 UTC
Detection
1 rule
Source quality
A2Roughly even chance

Kerberoasting is an attack technique where an actor requests service tickets (TGS) for service accounts from a Domain Controller and attempts to crack the service ticket offline to recover the account password. This rule monitors Windows Event ID 4769 to identify requests using RC4 encryption (0x17), which is a common indicator of Kerberoasting, while filtering out known benign activity such as machine account authentication and requests for the krbtgt service. This rule serves as a base for behavior-based detection and should be combined with threshold analysis to identify anomalous request patterns.

Recommendation

  • Deploy the provided Sigma rule to your SIEM to monitor for Kerberoasting activity.
  • Establish a baseline of normal service ticket request volume for your environment.
  • Implement alert thresholds to trigger on high volumes of 4769 events with RC4 encryption (0x17) originating from a single source within a 5-second window.
  • Filter out legacy applications that require RC4 encryption to prevent false positives.

Immediate actions

Enable logging for Kerberos Service Ticket Operations on Domain Controllers

IT Operations 48h

Deploy Sigma rule for Kerberoasting activity

Detection Engineering 72h

Threat Hunt

Identify high-frequency Event ID 4769 events for a single source IP targeting multiple unique service names within a short window

T1558.003 high high confidence hunt now

Data: Event ID 4769 (Source Address, TargetUserName, ServiceName, TicketEncryptionType)

Detection coverage 1

Detect Kerberoasting Activity via Event 4769

medium

Detects potentially malicious Kerberoasting activity by identifying RC4-encrypted service ticket requests (Event ID 4769), excluding standard machine account and krbtgt traffic.

sigma tactics: credential-access techniques: T1558.003 sources: security, windows

Detection queries are available on the platform. Get full rules →