Kerberoasting - Abnormal Volume of RC4 TGS Requests (T1558.003)

Ibrahim Saud@tektrix

•updated 16 days ago•0•0•0

Detects a single account requesting an abnormally large number of Kerberos service tickets (Event ID 4769) using weak RC4 encryption (0x17) within a short window. This pattern is characteristic of Kerberoasting attacks, where an adversary requests service tickets for offline password cracking.