Kerberoasting: RC4 TGS-REQ Spike Across Multiple SPNs (4769)

Ibrahim Saud@tektrix

•updated 8 days ago•0•0•1

Detects anomalous Kerberos TGS-REQ activity (Event ID 4769) from a single user account targeting five or more distinct Service Principal Names (SPNs) using RC4 encryption (0x17). This pattern is consistent with Kerberoasting techniques used by offensive tools like Rubeus, where service tickets are requested for offline cracking to extract plaintext service account credentials.