AS-REP Roasting via Kerberos Event 4768 - T1558.004

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•2

Detects AS-REQ requests for accounts where Kerberos pre-authentication is disabled (PreAuthType 0) and insecure ticket encryption types (0x17, 0x18, 0x1) are used. This behavior is indicative of an AS-REP Roasting attack, where an adversary attempts to obtain the encrypted AS-REP response for an account to perform offline brute-force password cracking.