Kerberos Ticket Using RC4 Encryption

Daniel Koifman@Koifsec

•updated Mar 1, 2026•11•0•141

This rule alerts when A Kerberos authentication ticket (TGT) was requested or generated using encryption type 0x17 (RC4-HMAC).