Suspicious Kerberos Network Traffic RC4 Ticket Encryption (via kerberos)

title: Suspicious Kerberos Network Traffic RC4 Ticket Encryption (via kerberos)
id: 20adf91c-f6a5-5921-8f6d-4c30df6b4c88
status: stable
description: This rule detects kerberos TGS request using RC4 encryption which may be indicative of kerberoasting
references:
    - https://attack.mitre.org/techniques/T1558/003/
    - https://adsecurity.org/?p=3458
author: Huntrule Team
date: 2026-03-22
tags:
    - attack.credential-access
    - attack.t1558.003
logsource:
    product: zeek
    service: kerberos
detection:
    selection:
        request_type: 'TGS'
        cipher: 'rc4-hmac'
    computer_acct:
        service|startswith: '$'
    condition: selection and not computer_acct
falsepositives:
    - Unknown
level: medium