Windows Kerberos Service Tickets Requesting RC4 Encryption (EventID 4769)
Flags Windows Kerberos service ticket requests using RC4 encryption while excluding '$' machine/service accounts.
- Product
- windows
- Service
- security
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2017-02-06
- Updated
- 2026-07-31
ATT&CK techniques
Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Kerberos service ticket requests that specify RC4 as the ticket encryption type and match a particular TicketOptions value. Attackers may use weaker or targeted encryption settings to facilitate credential access attempts such as offline cracking of extracted ticket material. It relies on Windows Security auditing telemetry for EventID 4769, including TicketOptions, TicketEncryptionType, and ServiceName to suppress likely benign machine-account behavior.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Kerberos Service Tickets Requesting RC4 Encryption (EventID 4769)
id: 58859774-b359-4a62-b0f9-6c8d5b39c4c5
status: test
description: This rule flags Kerberos service ticket requests that specify RC4 as the ticket encryption type and match a particular TicketOptions value. Attackers may use weaker or targeted encryption settings to facilitate credential access attempts such as offline cracking of extracted ticket material. It relies on Windows Security auditing telemetry for EventID 4769, including TicketOptions, TicketEncryptionType, and ServiceName to suppress likely benign machine-account behavior.
references:
- https://adsecurity.org/?p=3458
- https://www.trimarcsecurity.com/single-post/TrimarcResearch/Detecting-Kerberoasting-Activity
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_susp_rc4_kerberos.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-02-06
modified: 2022-06-19
tags:
- attack.credential-access
- attack.t1558.003
logsource:
product: windows
service: security
detection:
selection:
EventID: 4769
TicketOptions: "0x40810000"
TicketEncryptionType: "0x17"
reduction:
ServiceName|endswith: $
condition: selection and not reduction
falsepositives:
- Service accounts used on legacy systems (e.g. NetApp)
- Windows Domains with DFL 2003 and legacy systems
level: medium
license: DRL-1.1
related:
- id: 496a0e47-0a33-4dca-b009-9e6ca3591f39
type: derived