Kerberoasting - RC4 TGS Ticket Request Detected
Detects Kerberos Ticket Granting Service (TGS) requests using RC4 encryption (etype 0x17) by non-service accounts, which is a common indicator of a Kerberoasting attack where adversaries attempt to crack service account passwords offline.
Microsoft Sentinel (KQL)
