Windows Security 4769 Kerberoasting Precursor Query (RC4 TGT Service Requests)

title: Windows Security 4769 Kerberoasting Precursor Query (RC4 TGT Service Requests)
id: 75f7d88a-be8c-4572-a3c2-746cf41005db
status: test
description: This rule gathers Windows Security events indicating successful Kerberos service ticket requests (EventID 4769) where the ticket encryption type is RC4 (0x17), a common prerequisite signal for kerberoasting activity. It narrows to requests whose ServiceName does not end with "krbtgt" and excludes service names ending with "$" as well as TargetUserName values containing "$@" to reduce benign Kerberos noise. It relies on Security log telemetry fields for EventID, status, TicketEncryptionType, ServiceName, and TargetUserName so follow-on analysis can determine suspicious request patterns across a short time window.
references:
  - https://www.trustedsec.com/blog/art_of_kerberoast/
  - https://adsecurity.org/?p=3513
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_kerberoasting_activity.yml
author: "@kostastsale, Huntrule Team"
date: 2022-01-21
modified: 2025-10-19
tags:
  - attack.credential-access
  - attack.t1558.003
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4769
    Status: "0x0"
    TicketEncryptionType: "0x17"
  filter_main_krbtgt:
    ServiceName|endswith:
      - krbtgt
      - $
  filter_main_machine_accounts:
    TargetUserName|contains: $@
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Legacy applications.
level: medium
license: DRL-1.1
related:
  - id: d04ae2b8-ad54-4de0-bd87-4bc1da66aa59
    type: derived