Windows Kerberos Key Distribution Center errors: no suitable key or unsupported encryption type

title: "Windows Kerberos Key Distribution Center errors: no suitable key or unsupported encryption type"
id: e5ae7aa9-4ff8-4408-bb0c-373560270021
status: test
description: This rule matches Windows System events from the Kerberos Key Distribution Center indicating it could not generate a TGS due to missing key overlap or an unsupported encryption type request. Such failures matter because attackers and misconfigurations may trigger repeated Kerberos ticket requests that cannot be served, potentially exposing weaknesses in encryption negotiation. The detection relies on Kerberos Key Distribution Center event provider names and EventID 16 or 27 in Windows System telemetry.
references:
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd348773(v=ws.10)
  - https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/kdc-event-16-27-des-encryption-disabled
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/microsoft_windows_kerberos_key_distribution_center/win_system_kdcsvc_tgs_no_suitable_encryption_key_found.yml
author: "@SerkinValery, Huntrule Team"
date: 2024-03-07
modified: 2025-09-22
tags:
  - attack.credential-access
  - attack.t1558.003
logsource:
  product: windows
  service: system
detection:
  selection:
    Provider_Name:
      - Kerberos-Key-Distribution-Center
      - Microsoft-Windows-Kerberos-Key-Distribution-Center
    EventID:
      - 16
      - 27
  condition: selection
falsepositives:
  - Unknown
level: low
license: DRL-1.1
related:
  - id: b1e0b3f5-b62e-41be-886a-daffde446ad4
    type: derived