Windows Security Event 4769: Kerberos Service Tickets Requested with RC4 Encryption

Flags Windows Kerberos service ticket requests using RC4 encryption while excluding '$' machine/service accounts.

FreeUnreviewedSigmamediumv1

windows-security-event-4769-kerberos-service-tickets-requested-with-rc4-encrypti-496a0e47

title: "Windows Security Event 4769: Kerberos Service Tickets Requested with RC4 Encryption"
id: 58859774-b359-4a62-b0f9-6c8d5b39c4c5
status: test
description: This rule identifies Kerberos service ticket requests (EventID 4769) where the ticket encryption type is RC4, excluding computer/service accounts with a trailing '$'. Attackers may request RC4-encrypted service tickets to support credential theft techniques tied to Kerberos encryption negotiation and service ticket behavior. It relies on Windows Security log fields for TicketEncryptionType, TicketOptions, and ServiceName processing to reduce expected machine/service account noise.
references:
  - https://adsecurity.org/?p=3458
  - https://www.trimarcsecurity.com/single-post/TrimarcResearch/Detecting-Kerberoasting-Activity
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_susp_rc4_kerberos.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-02-06
modified: 2022-06-19
tags:
  - attack.credential-access
  - attack.t1558.003
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4769
    TicketOptions: "0x40810000"
    TicketEncryptionType: "0x17"
  reduction:
    ServiceName|endswith: $
  condition: selection and not reduction
falsepositives:
  - Service accounts used on legacy systems (e.g. NetApp)
  - Windows Domains with DFL 2003 and legacy systems
level: medium
license: DRL-1.1
related:
  - id: 496a0e47-0a33-4dca-b009-9e6ca3591f39
    type: derived

What it detects

This rule identifies Kerberos service ticket requests (EventID 4769) where the ticket encryption type is RC4, excluding computer/service accounts with a trailing '$'. Attackers may request RC4-encrypted service tickets to support credential theft techniques tied to Kerberos encryption negotiation and service ticket behavior. It relies on Windows Security log fields for TicketEncryptionType, TicketOptions, and ServiceName processing to reduce expected machine/service account noise.

Known false positives

Service accounts used on legacy systems (e.g. NetApp)
Windows Domains with DFL 2003 and legacy systems

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.