AS-REP Roasting - Kerberos Pre-Auth Disabled Account Targeted

Ankit Mehta@Secvyn

•updated Jun 29, 2026•1•0•2

Detects Kerberos Authentication Service Requests (AS-REQ) resulting in a ticket granting ticket (TGT) where the TicketOptions field is set to '0x40810010'. This specific combination is often associated with the behavior of tools performing Kerberoasting or specific types of ticket-based attacks, as it indicates a TGT request that may bypass standard pre-authentication or follow non-standard flow patterns.