Silver Ticket: TGS Use (4769) Without Prior TGT Request (4768)

Ankit Mehta@Secvyn

•updated 28 days ago•0•0•5

This rule detects instances where a Kerberos Service Ticket (TGS, Event ID 4769) is requested without a corresponding TGT request (AS-REQ, Event ID 4768) from the same user and IP address within a 10-hour window. This behavior is indicative of potential Kerberoasting, where an attacker may have obtained TGS tickets using cached or manually constructed credentials rather than through the normal authentication flow.