Kerberoasting via Bulk RC4 TGS Requests (4769)

Ibrahim Saud@tektrix

•updated 12 days ago•0•0•1

Detects a single user account performing an unusually high volume of Kerberos Service Ticket (TGS) requests (Event ID 4769) within a short window, specifically using RC4 encryption (0x17). This behavior is highly characteristic of Kerberoasting, where attackers request tickets for various service principal names (SPNs) to perform offline password cracking.