Windows Kerberos KDC Key Distribution Failure: No Suitable Encryption Key or Unsupported EType
Flags KDC TGS generation failures where no suitable encryption key intersects or the requested encryption type is unsupported.
- Product
- windows
- Service
- system
- Author
- @SerkinValery (SigmaHQ), DRL 1.1
- Published
- 2024-03-07
- Updated
- 2026-07-31
ATT&CK techniques
Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows System events from the Kerberos Key Distribution Center indicating the KDC could not generate a TGS due to a missing key intersection or an unsupported encryption type request. Such failures can matter because attackers probing Kerberos services may trigger repeated key/etype negotiation errors when targeting accounts or services with incompatible encryption settings. Telemetry relies on Windows System logs containing Kerberos KDC provider names with Event IDs 16 and 27.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd348773(v=ws.10)
- learn.microsoft.comhttps://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/kdc-event-16-27-des-encryption-disabled
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/microsoft_windows_kerberos_key_distribution_center/win_system_kdcsvc_tgs_no_suitable_encryption_key_found.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Kerberos KDC Key Distribution Failure: No Suitable Encryption Key or Unsupported EType"
id: e5ae7aa9-4ff8-4408-bb0c-373560270021
status: test
description: This rule flags Windows System events from the Kerberos Key Distribution Center indicating the KDC could not generate a TGS due to a missing key intersection or an unsupported encryption type request. Such failures can matter because attackers probing Kerberos services may trigger repeated key/etype negotiation errors when targeting accounts or services with incompatible encryption settings. Telemetry relies on Windows System logs containing Kerberos KDC provider names with Event IDs 16 and 27.
references:
- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd348773(v=ws.10)
- https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/kdc-event-16-27-des-encryption-disabled
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/microsoft_windows_kerberos_key_distribution_center/win_system_kdcsvc_tgs_no_suitable_encryption_key_found.yml
author: "@SerkinValery, Huntrule Team"
date: 2024-03-07
modified: 2025-09-22
tags:
- attack.credential-access
- attack.t1558.003
logsource:
product: windows
service: system
detection:
selection:
Provider_Name:
- Kerberos-Key-Distribution-Center
- Microsoft-Windows-Kerberos-Key-Distribution-Center
EventID:
- 16
- 27
condition: selection
falsepositives:
- Unknown
level: low
license: DRL-1.1
related:
- id: b1e0b3f5-b62e-41be-886a-daffde446ad4
type: derived