Kerberoasting via RC4 Kerberos Service Ticket Request (EventID 4769)

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•2

Detects Kerberos Ticket Granting Service (TGS) requests using RC4 encryption (0x17), which is a common indicator of Kerberoasting. The rule excludes common non-user account ticket requests (machine accounts and krbtgt) to reduce noise, focusing on potential service account targeting.