Windows Kerberos Service Tickets Requesting RC4 Encryption (EventID 4769)

Flags Windows Kerberos service ticket requests using RC4 encryption while excluding '$' machine/service accounts.

FreeReviewedSigma · Medium · v2

Product: windows
Service: security
Author: Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2017-02-06
Updated: 2026-07-31

ATT&CK techniques

Cred Access

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1558.003Kerberoasting
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Kerberos service ticket requests that specify RC4 as the ticket encryption type and match a particular TicketOptions value. Attackers may use weaker or targeted encryption settings to facilitate credential access attempts such as offline cracking of extracted ticket material. It relies on Windows Security auditing telemetry for EventID 4769, including TicketOptions, TicketEncryptionType, and ServiceName to suppress likely benign machine-account behavior.

Reporting behind it

Related detections9 linkedT1558.003 — drag to rearrange

Malicious Kerberos Ticket File Creation Indicating Credential Theft (via file_event)

Suspicious Kerberoasting via setspn Service Principal Query

Masquerading Kerberos Ticket Abuse via Rubeus (via process_creation)

Possible Targeted Kerberoasting via servicePrincipalName Modification

Suspicious SQL Service Principal Name Enumeration via Setspn

Windows: Suspicious Kerberos Ticket Requests from PowerShell Using KerberosRequestorSecurityToken

Windows Process Creation: RemoteKrbRelay Kerberos Relay Tool Execution

Windows Kerberos KDC Key Distribution Failure: No Suitable Encryption Key or Unsupported EType

Rubeus HackTool Execution via PowerShell ScriptBlock Flags (Windows)

Windows Kerberos Service Tickets Requesting RC4 Encryption (EventID 4769)

Pivot detection · T1558.003 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-security-event-4769-kerberos-service-tickets-requested-with-rc4-encrypti-496a0e47

title: Windows Kerberos Service Tickets Requesting RC4 Encryption (EventID 4769)
id: 58859774-b359-4a62-b0f9-6c8d5b39c4c5
status: test
description: This rule flags Kerberos service ticket requests that specify RC4 as the ticket encryption type and match a particular TicketOptions value. Attackers may use weaker or targeted encryption settings to facilitate credential access attempts such as offline cracking of extracted ticket material. It relies on Windows Security auditing telemetry for EventID 4769, including TicketOptions, TicketEncryptionType, and ServiceName to suppress likely benign machine-account behavior.
references:
  - https://adsecurity.org/?p=3458
  - https://www.trimarcsecurity.com/single-post/TrimarcResearch/Detecting-Kerberoasting-Activity
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_susp_rc4_kerberos.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-02-06
modified: 2022-06-19
tags:
  - attack.credential-access
  - attack.t1558.003
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4769
    TicketOptions: "0x40810000"
    TicketEncryptionType: "0x17"
  reduction:
    ServiceName|endswith: $
  condition: selection and not reduction
falsepositives:
  - Service accounts used on legacy systems (e.g. NetApp)
  - Windows Domains with DFL 2003 and legacy systems
level: medium
license: DRL-1.1
related:
  - id: 496a0e47-0a33-4dca-b009-9e6ca3591f39
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL