Windows Kerberos TGT Issue Operations Failures (Event IDs 675/4768/4769/4771)

ATT&CK techniques

Cred Access

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1212Exploitation for Credential Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows Security events indicating failed Kerberos Ticket-Granting Ticket (TGT) issue operations, based on matching Event IDs 675, 4768, 4769, and 4771 together with specific failure statuses. Attackers may manipulate Kerberos TGT-related messages or attempt authentication flows to disrupt or obtain tickets, and repeated failures can be a useful indicator. The detection relies on Windows Security log telemetry with these event IDs and the enumerated status codes.

Reporting behind it

Related detections4 linkedT1212 — drag to rearrange

Windows Rundll32 Calls DavSetCookie for NTLM Coercion via Spoolss/Srvsvc

Apache Guacamole Linux: Two-User Session Presence Anomaly

Windows Process Creation alerts on GALLIUM-associated hash IOCs

Windows Audit-CVE: User Applications Writing CveEventWrite Events (Event ID 1)

Windows Kerberos TGT Issue Operations Failures (Event IDs 675/4768/4769/4771)

Pivot detection · T1212 · 4 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-security-failed-kerberos-tgt-request-event-675-4768-4769-4771-f7644214

title: Windows Kerberos TGT Issue Operations Failures (Event IDs 675/4768/4769/4771)
id: 362224ac-e75c-4d9e-8cd9-e15ceb4b2fd6
status: test
description: This rule flags Windows Security events indicating failed Kerberos Ticket-Granting Ticket (TGT) issue operations, based on matching Event IDs 675, 4768, 4769, and 4771 together with specific failure statuses. Attackers may manipulate Kerberos TGT-related messages or attempt authentication flows to disrupt or obtain tickets, and repeated failures can be a useful indicator. The detection relies on Windows Security log telemetry with these event IDs and the enumerated status codes.
references:
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4771
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_susp_kerberos_manipulation.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-02-10
modified: 2024-01-16
tags:
  - attack.credential-access
  - attack.t1212
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID:
      - 675
      - 4768
      - 4769
      - 4771
    Status:
      - "0x9"
      - "0xA"
      - "0xB"
      - "0xF"
      - "0x10"
      - "0x11"
      - "0x13"
      - "0x14"
      - "0x1A"
      - "0x1F"
      - "0x21"
      - "0x22"
      - "0x23"
      - "0x24"
      - "0x26"
      - "0x27"
      - "0x28"
      - "0x29"
      - "0x2C"
      - "0x2D"
      - "0x2E"
      - "0x2F"
      - "0x31"
      - "0x32"
      - "0x3E"
      - "0x3F"
      - "0x40"
      - "0x41"
      - "0x43"
      - "0x44"
  condition: selection
falsepositives:
  - Faulty legacy applications
level: high
license: DRL-1.1
related:
  - id: f7644214-0eb0-4ace-9455-331ec4c09253
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL