Windows Kerberos TGT Request with AD CS Certificate Thumbprint Anomalies (EventID 4768)
Identifies unusual certificate-associated Kerberos TGT (4768) requests targeting computer accounts on Windows.
- Product
- windows
- Service
- security
- Author
- Mauricio Velazco, Michael Haag (SigmaHQ), DRL 1.1
- Published
- 2021-09-02
- Updated
- 2026-07-31
ATT&CK techniques
Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags suspicious Kerberos Ticket Granting Ticket (TGT) requests by matching Windows Security events with EventID 4768 where the target account looks like a machine account (TargetUserName ends with '$') and the certificate thumbprint field is present (CertThumbprint contains '*'). Such behavior can indicate an attacker using an issued certificate to obtain Kerberos tickets for malicious follow-on activity. The detection relies on Windows Security audit telemetry (EventID 4768) and the presence of certificate-related fields in the event, with additional exclusions for local IP activity and empty thumbprints.
Reporting behind it
- github.comhttps://github.com/topotam/PetitPotam
- isc.sans.eduhttps://isc.sans.edu/forums/diary/Active+Directory+Certificate+Services+ADCS+PKI+domain+admin+vulnerability/27668/
- github.comhttps://github.com/splunk/security_content/blob/88d689fe8a055d8284337b9fad5d9152b42043db/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_petitpotam_susp_tgt_request.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Kerberos TGT Request with AD CS Certificate Thumbprint Anomalies (EventID 4768)
id: 823d7a47-9ce3-4651-989c-1998c4ee6b56
status: test
description: This rule flags suspicious Kerberos Ticket Granting Ticket (TGT) requests by matching Windows Security events with EventID 4768 where the target account looks like a machine account (TargetUserName ends with '$') and the certificate thumbprint field is present (CertThumbprint contains '*'). Such behavior can indicate an attacker using an issued certificate to obtain Kerberos tickets for malicious follow-on activity. The detection relies on Windows Security audit telemetry (EventID 4768) and the presence of certificate-related fields in the event, with additional exclusions for local IP activity and empty thumbprints.
references:
- https://github.com/topotam/PetitPotam
- https://isc.sans.edu/forums/diary/Active+Directory+Certificate+Services+ADCS+PKI+domain+admin+vulnerability/27668/
- https://github.com/splunk/security_content/blob/88d689fe8a055d8284337b9fad5d9152b42043db/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_petitpotam_susp_tgt_request.yml
author: Mauricio Velazco, Michael Haag, Huntrule Team
date: 2021-09-02
modified: 2022-10-05
tags:
- attack.credential-access
- attack.t1187
logsource:
product: windows
service: security
definition: The advanced audit policy setting "Account Logon > Kerberos Authentication Service" must be configured for Success/Failure
detection:
selection:
EventID: 4768
TargetUserName|endswith: $
CertThumbprint|contains: "*"
filter_local:
IpAddress: ::1
filter_thumbprint:
CertThumbprint: ""
condition: selection and not 1 of filter_*
falsepositives:
- False positives are possible if the environment is using certificates for authentication. We recommend filtering Account_Name to the Domain Controller computer accounts.
level: high
license: DRL-1.1
related:
- id: 6a53d871-682d-40b6-83e0-b7c1a6c4e3a5
type: derived