Golden Ticket Kerberos TGS Request Anomaly (Event 4769)

Ibrahim Saud@tektrix

•updated 16 days ago•0•0•0

Detects Kerberos service ticket requests (TGS-REQ) using RC4 encryption (etype 0x17) and specific ticket options (0x40810000), which are commonly associated with Kerberoasting attacks. This rule filters out service accounts (ending in $) to reduce noise, as these legitimate account types frequently request tickets.