Windows Kerberoasting Initial Query: Successful 4769 RC4 Service Requests with Filters

Collects successful Windows 4769 RC4 service-ticket requests while excluding krbtgt and computer/service account patterns for kerberoasting triage.

FreeReviewedSigma · Medium · v2

Product: windows
Service: security
Author: @kostastsale (SigmaHQ), DRL 1.1
Published: 2022-01-21
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Cred Access

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1558.003Kerberoasting
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule gathers telemetry related to potential Kerberoasting by selecting successful Windows Security Event ID 4769 service ticket requests that use RC4 ticket encryption (TicketEncryptionType 0x17). It filters out requests for service names ending in krbtgt and machine/service account patterns (e.g., usernames containing '$@' and service names ending with '$') to reduce noise from normal Kerberos traffic. It relies on Windows Security log fields EventID, Status, ServiceName, TicketEncryptionType, and TargetUserName for its matches.

Reporting behind it

Related detections9 linkedT1558.003 — drag to rearrange

Windows HackTool Execution: GoldenDMSA.exe Launch with Directory Manipulation Parameters

Possible Kerberoasting via RC4 Service Ticket Requests

Suspicious LDAP Query Enumerating Kerberos Preauth Disabled Accounts with Whitespace Evasion

Suspicious Kerberoasting LDAP Search Filter for Service Principal Names

Suspicious Kerberoasting via RC4 Service Ticket Request for MSSQLSvc SPN (via security)

Malicious Kerberos Ticket File Creation Indicating Credential Theft (via file_event)

Suspicious Kerberoasting via setspn Service Principal Query

Masquerading Kerberos Ticket Abuse via Rubeus (via process_creation)

Possible Targeted Kerberoasting via servicePrincipalName Modification

Windows Kerberoasting Initial Query: Successful 4769 RC4 Service Requests with Filters

Pivot detection · T1558.003 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-security-4769-kerberoasting-precursor-query-rc4-tgt-service-requests-d04ae2b8

title: "Windows Kerberoasting Initial Query: Successful 4769 RC4 Service Requests with Filters"
id: 75f7d88a-be8c-4572-a3c2-746cf41005db
status: test
description: This rule gathers telemetry related to potential Kerberoasting by selecting successful Windows Security Event ID 4769 service ticket requests that use RC4 ticket encryption (TicketEncryptionType 0x17). It filters out requests for service names ending in krbtgt and machine/service account patterns (e.g., usernames containing '$@' and service names ending with '$') to reduce noise from normal Kerberos traffic. It relies on Windows Security log fields EventID, Status, ServiceName, TicketEncryptionType, and TargetUserName for its matches.
references:
  - https://www.trustedsec.com/blog/art_of_kerberoast/
  - https://adsecurity.org/?p=3513
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_kerberoasting_activity.yml
author: "@kostastsale, Huntrule Team"
date: 2022-01-21
modified: 2025-10-19
tags:
  - attack.credential-access
  - attack.t1558.003
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4769
    Status: "0x0"
    TicketEncryptionType: "0x17"
  filter_main_krbtgt:
    ServiceName|endswith:
      - krbtgt
      - $
  filter_main_machine_accounts:
    TargetUserName|contains: $@
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Legacy applications.
level: medium
license: DRL-1.1
related:
  - id: d04ae2b8-ad54-4de0-bd87-4bc1da66aa59
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL