Windows Kerberos Replay Attack Likely Activity on Domain Controllers (Event ID 4649)
Alerts on Windows Security Event 4649 indicating a Kerberos replay error (KRB_AP_ERR_REPEAT).
- Product
- windows
- Service
- security
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-10-14
- Updated
- 2026-07-31
ATT&CK techniques
Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows Security audit events on domain controllers where a Kerberos response indicating KRB_AP_ERR_REPEAT is logged (Event ID 4649). An attacker may use replayed Kerberos authentication messages to bypass freshness checks and attempt credential abuse. The detection relies on the presence of the specific Kerberos replay-related event captured in Windows Security logs.
Reporting behind it
- github.comhttps://github.com/Yamato-Security/EnableWindowsLogSettings/blob/7f6d755d45ac7cc9fc35b0cbf498e6aa4ef19def/ConfiguringSecurityLogAuditPolicies.md
- learn.microsoft.comhttps://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4649
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_replay_attack_detected.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Kerberos Replay Attack Likely Activity on Domain Controllers (Event ID 4649)
id: aa6503d3-a25e-45e9-83da-125e64383f34
status: test
description: This rule flags Windows Security audit events on domain controllers where a Kerberos response indicating KRB_AP_ERR_REPEAT is logged (Event ID 4649). An attacker may use replayed Kerberos authentication messages to bypass freshness checks and attempt credential abuse. The detection relies on the presence of the specific Kerberos replay-related event captured in Windows Security logs.
references:
- https://github.com/Yamato-Security/EnableWindowsLogSettings/blob/7f6d755d45ac7cc9fc35b0cbf498e6aa4ef19def/ConfiguringSecurityLogAuditPolicies.md
- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4649
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_replay_attack_detected.yml
author: frack113, Huntrule Team
date: 2022-10-14
tags:
- attack.credential-access
- attack.t1558
logsource:
service: security
product: windows
detection:
selection:
EventID: 4649
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 5a44727c-3b85-4713-8c44-4401d5499629
type: derived