author: Yusuke Matsui, Yamato Security
creation_date: 2020/11/08
updated_date: 2021/11/26

title: Possible AS-REP Roasting
title_jp: AS-REPロースティングの可能性
output: 'Possible AS-REP Roasting'
output_jp: 'AS-REPロースティングのリスクがある'
description: For each account found without preauthentication, an adversary may send an AS-REQ message without the encrypted timestamp and receive an AS-REP message with TGT data which may be encrypted with an insecure algorithm such as RC4.
description_jp: For each account found without preauthentication, an adversary may send an AS-REQ message without the encrypted timestamp and receive an AS-REP message with TGT data which may be encrypted with an insecure algorithm such as RC4.

id: dee2a01e-5d7c-45b4-aec3-ad9722f2165a
level: medium
status: test
detection:
    selection:
        Channel: Security
        EventID: 4768
        TicketEncryptionType: '0x17' #RC4-HMAC
        PreAuthType: 0 #Logon without pre-authentication
    condition: selection
falsepositives:
    - legacy application
tags:
    - attack.credential_access
    - attack.t1558.004
references:
    - https://attack.mitre.org/techniques/T1558/004/
ruletype: hayabusa