Windows Security Events: Kerberos TGT Requests with PreAuth Disabled and RC4-HMAC

Alerts on krbtgt TGT requests using RC4-HMAC with pre-authentication disabled (PreAuthType=0), consistent with AS-REP roasting attempts.

FreeUnreviewedSigmamediumv1

windows-security-events-kerberos-tgt-requests-with-preauth-disabled-and-rc4-hmac-3e2f1b2c

title: "Windows Security Events: Kerberos TGT Requests with PreAuth Disabled and RC4-HMAC"
id: 14ea2ce5-b00c-4097-af47-754dab252e3e
status: experimental
description: This rule flags Windows Security Event ID 4768 when a Kerberos TGT request targets krbtgt with Pre-Authentication Type set to 0 and Ticket Encryption Type set to 0x17 (RC4-HMAC). Such combinations can indicate attempts to obtain AS-REP data from accounts without pre-authentication and then crack the encrypted material offline to recover credentials. It relies on telemetry from Windows Security logs capturing the TGT request attributes (PreAuthType, TicketEncryptionType, ServiceName, and EventID).
references:
  - https://medium.com/system-weakness/detecting-as-rep-roasting-attacks-b5b3965f9714
  - https://www.picussecurity.com/resource/blog/as-rep-roasting-attack-explained-mitre-attack-t1558.004
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_kerberos_asrep_roasting.yml
author: ANosir, Huntrule Team
date: 2025-05-22
modified: 2025-07-04
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4768
    TicketEncryptionType: "0x17"
    ServiceName: krbtgt
    PreAuthType: 0
  condition: selection
falsepositives:
  - Legacy systems or applications that legitimately use RC4 encryption
  - Misconfigured accounts with pre-authentication disabled
level: medium
license: DRL-1.1
related:
  - id: 3e2f1b2c-4d5e-11ee-be56-0242ac120002
    type: derived

What it detects

This rule flags Windows Security Event ID 4768 when a Kerberos TGT request targets krbtgt with Pre-Authentication Type set to 0 and Ticket Encryption Type set to 0x17 (RC4-HMAC). Such combinations can indicate attempts to obtain AS-REP data from accounts without pre-authentication and then crack the encrypted material offline to recover credentials. It relies on telemetry from Windows Security logs capturing the TGT request attributes (PreAuthType, TicketEncryptionType, ServiceName, and EventID).

Known false positives

Legacy systems or applications that legitimately use RC4 encryption
Misconfigured accounts with pre-authentication disabled

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.