AS-REP Roasting - Kerberos Pre-Authentication Disabled Account Request

Ankit Mehta@Secvyn

•updated Jun 29, 2026•1•0•2

Detects Kerberos AS-REQ events (Event ID 4768) where pre-authentication is not used (PreAuthType 0). This is a common indicator of attempts to perform Kerberoasting or AS-REP roasting, as attackers may attempt to request tickets for accounts without requiring the initial pre-authentication step.