Windows Security: Kerberos TGT requests with PreAuthType=0 and RC4-HMAC (0x17) to krbtgt
Alerts on krbtgt TGT requests using RC4-HMAC with pre-authentication disabled (PreAuthType=0), consistent with AS-REP roasting attempts.
- Product
- windows
- Service
- security
- Author
- ANosir (SigmaHQ), DRL 1.1
- Published
- 2025-05-22
- Updated
- 2026-07-31
What it detects
This rule flags Windows Security events where Kerberos TGT requests are made to the krbtgt service with pre-authentication disabled (PreAuthType=0) and Ticket Encryption Type set to 0x17 (RC4-HMAC). Disabling pre-authentication and using RC4-HMAC can allow attackers to obtain ticket material that may be subjected to offline password guessing. It relies on Security event telemetry (EventID 4768) and the event fields ServiceName, PreAuthType, and TicketEncryptionType.
Reporting behind it
- medium.comhttps://medium.com/system-weakness/detecting-as-rep-roasting-attacks-b5b3965f9714
- picussecurity.comhttps://www.picussecurity.com/resource/blog/as-rep-roasting-attack-explained-mitre-attack-t1558.004
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_kerberos_asrep_roasting.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Security: Kerberos TGT requests with PreAuthType=0 and RC4-HMAC (0x17) to krbtgt"
id: 14ea2ce5-b00c-4097-af47-754dab252e3e
status: experimental
description: This rule flags Windows Security events where Kerberos TGT requests are made to the krbtgt service with pre-authentication disabled (PreAuthType=0) and Ticket Encryption Type set to 0x17 (RC4-HMAC). Disabling pre-authentication and using RC4-HMAC can allow attackers to obtain ticket material that may be subjected to offline password guessing. It relies on Security event telemetry (EventID 4768) and the event fields ServiceName, PreAuthType, and TicketEncryptionType.
references:
- https://medium.com/system-weakness/detecting-as-rep-roasting-attacks-b5b3965f9714
- https://www.picussecurity.com/resource/blog/as-rep-roasting-attack-explained-mitre-attack-t1558.004
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_kerberos_asrep_roasting.yml
author: ANosir, Huntrule Team
date: 2025-05-22
modified: 2025-07-04
logsource:
product: windows
service: security
detection:
selection:
EventID: 4768
TicketEncryptionType: "0x17"
ServiceName: krbtgt
PreAuthType: 0
condition: selection
falsepositives:
- Legacy systems or applications that legitimately use RC4 encryption
- Misconfigured accounts with pre-authentication disabled
level: medium
license: DRL-1.1
related:
- id: 3e2f1b2c-4d5e-11ee-be56-0242ac120002
type: derived