Kerberoasting burst of RC4 (0x17) service ticket requests (Event 4769)

ills3c Intel&Coffee@Ills3C

•updated yesterday•0•0•2

Detects a burst of Kerberos service ticket requests (Event ID 4769) utilizing weak RC4 encryption (0x17) from a single account and IP address within a short time window. This behavior is indicative of Kerberoasting activity, where adversaries request TGS tickets for multiple service principal names (SPNs) to offline brute-force the service account passwords.