Golden Ticket - Kerberos krbtgt RC4 Service Ticket Request (4769)

Ankit Mehta@Secvyn

•updated Jun 29, 2026•7•0•2

Detects Kerberos service ticket requests (TGS) where the encryption type is set to 0x17 (RC4-HMAC). This is commonly used in Kerberoasting attacks to capture service ticket hashes for offline brute-force attacks.