Important Detection 2026: Kerberoasting via Abnormal TGS Ticket Requests

Ibrahim Saud@tektrix

•updated 5 days ago•0•0•0

Detects anomalous Kerberos TGS ticket requests (Event ID 4769) where a single user requests tickets for multiple distinct Service Principal Names (SPNs) using weak RC4 (0x17) encryption. This behavior is highly characteristic of Kerberoasting, a technique used by adversaries to harvest service account tickets for offline cracking.