huntrule

Windows Kerberoasting Initial Query: Successful 4769 RC4 Service Requests with Filters

Collects successful Windows 4769 RC4 service-ticket requests while excluding krbtgt and computer/service account patterns for kerberoasting triage.

FreeReviewedSigma · Medium · v2
Product
windows
Service
security
Author
@kostastsale (SigmaHQ), DRL 1.1
Published
2022-01-21
Updated
2026-07-31
AnalysisDetection
title: "Windows Kerberoasting Initial Query: Successful 4769 RC4 Service Requests with Filters"
id: 75f7d88a-be8c-4572-a3c2-746cf41005db
status: test
description: This rule gathers telemetry related to potential Kerberoasting by selecting successful Windows Security Event ID 4769 service ticket requests that use RC4 ticket encryption (TicketEncryptionType 0x17). It filters out requests for service names ending in krbtgt and machine/service account patterns (e.g., usernames containing '$@' and service names ending with '$') to reduce noise from normal Kerberos traffic. It relies on Windows Security log fields EventID, Status, ServiceName, TicketEncryptionType, and TargetUserName for its matches.
references:
  - https://www.trustedsec.com/blog/art_of_kerberoast/
  - https://adsecurity.org/?p=3513
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_kerberoasting_activity.yml
author: "@kostastsale, Huntrule Team"
date: 2022-01-21
modified: 2025-10-19
tags:
  - attack.credential-access
  - attack.t1558.003
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4769
    Status: "0x0"
    TicketEncryptionType: "0x17"
  filter_main_krbtgt:
    ServiceName|endswith:
      - krbtgt
      - $
  filter_main_machine_accounts:
    TargetUserName|contains: $@
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Legacy applications.
level: medium
license: DRL-1.1
related:
  - id: d04ae2b8-ad54-4de0-bd87-4bc1da66aa59
    type: derived