Kerberoasting: Excessive RC4 TGS-REQ Ticket Requests (T1558.003)

Ibrahim Saud@tektrix

•updated 12 days ago•0•0•1

This rule detects potential Kerberoasting activity by monitoring for an unusually high volume of Kerberos Service Ticket (TGS) requests (event ID 4769) for non-machine service accounts, specifically focusing on tickets encrypted with RC4 (etype 23). A high count of ticket requests or distinct Service Principal Names (SPNs) requested by a single client in a short period is characteristic of an adversary attempting to harvest hashes for offline cracking.