AS-REP Roasting: Multiple No-Preauth 4768 Requests from One Source

Ibrahim Saud@tektrix

•updated 12 days ago•0•0•1

Detects multiple Kerberos AS-REQ (Event ID 4768) requests initiated for distinct user accounts from a single source IP within a short timeframe (10 minutes) where Kerberos pre-authentication was not used (Pre-Authentication Type 0). This pattern is a key indicator of AS-REP roasting activity, often performed by tools like Rubeus or Impacket's GetNPUsers.py to harvest user TGTs for offline cracking.