Golden Ticket - Anomalous krbtgt Service Ticket Request

Ankit Mehta@Secvyn

•updated Jun 29, 2026•1•0•4

Detects Kerberoasting attempts by identifying suspicious Ticket Granting Service (TGS) requests (Event ID 4769) for the 'krbtgt' service or other services where the ticket encryption type is RC4 (0x17) or older/weaker encryption types (0x18), especially when these requests are not preceded by a corresponding Ticket Granting Ticket (TGT) request (Event ID 4768).