Possible Kerberoasting Behavior - Initial Query (via security)

title: Possible Kerberoasting Behavior - Initial Query (via security)
id: 054b20ca-f946-518b-b46b-d78067ba4e49
status: stable
description: This rule detects this rule will collect the data needed to start looking into possible kerberoasting activity. Further analysis or computation within the query is needed focusing on requests from one specific host/IP towards multiple service names within a time period of 5 seconds. You can then set a threshold for the number of requests and time between the requests to turn this into an alert.
references:
    - https://attack.mitre.org/techniques/T1558/003/
    - https://www.trustedsec.com/blog/art_of_kerberoast/
    - https://adsecurity.org/?p=3513
author: 'Huntrule Team'
date: 2026-07-09
tags:
    - attack.credential-access
    - attack.t1558.003
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4769
        Status: '0x0'
        TicketEncryptionType: '0x17'
    filter_main_krbtgt:
        ServiceName|endswith:
            - 'krbtgt'
            - '$'
    filter_main_machine_accounts:
        TargetUserName|contains: '$@'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: medium