AS-REP Roasting via Kerberos Pre-Auth Not Required (Event ID 4768)

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•2

This rule detects potential AS-REP Roasting attacks by monitoring for Kerberos TGT requests (Event ID 4768) where Kerberos pre-authentication is disabled (PreAuthType == 0) and the ticket encryption type uses weak algorithms (RC4-HMAC or AES128). This behavior allows an attacker to request a ticket for an account and perform offline password cracking.