Potential AS-REP Roasting via Kerberos TGT Requests

SigmaHQ Detections@sigmaHQ

•updated Jul 7, 2025•2•0•53

Detects suspicious Kerberos Ticket Granting Ticket (TGT) requests where pre-authentication is disabled (Pre-Authentication Type = 0) and the ticket encryption type is RC4-HMAC (0x17). This combination is indicative of an AS-REP Roasting attack, where an adversary requests AS-REP messages for accounts without pre-authentication and attempts to crack the encrypted ticket offline to recover user passwords.