high Sigma Windows

Kerberoasting via RC4 Service Ticket Request

TGS requests downgraded to RC4-HMAC - the encryption type attackers force so service-ticket hashes can be cracked offline.

Rule source

kerberoasting-rc4-service-ticket.yml

title: Kerberoasting via RC4 Service Ticket Request
id: 8c1d4b0e-6f2a-4a71-9a3d-2f0b5c7e1a44
status: stable
description: >
  Detects Kerberos TGS-REQ activity downgraded to RC4-HMAC, the encryption
  type attackers force so service ticket hashes can be cracked offline.
references:
  - https://attack.mitre.org/techniques/T1558/003/
author: DetectionOps
date: 2026/08/19
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4769
    TicketEncryptionType: '0x17'    # RC4-HMAC
    TicketOptions: '0x40810000'
  filter_machine_accounts:
    ServiceName|endswith: '$'
  filter_krbtgt:
    ServiceName: 'krbtgt'
  condition: selection and not 1 of filter_*
fields:
  - ServiceName
  - TargetUserName
  - IpAddress
falsepositives:
  - Legacy applications that genuinely negotiate RC4
  - Authenticated vulnerability scanners
level: high
tags:
  - attack.credential_access
  - attack.t1558.003

Required telemetry

Windows Security - Event ID 4769

Confirm this source is arriving before you judge the rule. A detection built on telemetry you do not collect looks identical to one that simply never fires.

Known false positives

Legacy applications and appliances that genuinely negotiate RC4
Domain functional level below 2008 where AES is unavailable
Authenticated vulnerability scanners

Validation

Atomic Red Team T1558.003-1 (Rubeus) against a lab SPN account

Re-run quarterly. Rules decay because the environment moves underneath them - agent upgrades, schema changes and config edits all break detections silently.