
title: Suspicious Kerberos RC4 Ticket Encryption
author: Florian Roth
date: 2017/02/06
description: Detects service ticket requests using RC4 encryption type
detection:
  SELECTION_1:
    EventID: 4769
  SELECTION_2:
    TicketOptions: '0x40810000'
  SELECTION_3:
    TicketEncryptionType: '0x17'
  SELECTION_4:
    ServiceName: $*
  condition: ((SELECTION_1 and SELECTION_2 and SELECTION_3) and  not (SELECTION_4))
falsepositives:
- Service accounts used on legacy systems (e.g. NetApp)
- Windows Domains with DFL 2003 and legacy systems
id: 496a0e47-0a33-4dca-b009-9e6ca3591f39
level: medium
logsource:
  product: windows
  service: security
modified: 2021/08/14
references:
- https://adsecurity.org/?p=3458
- https://www.trimarcsecurity.com/single-post/TrimarcResearch/Detecting-Kerberoasting-Activity
status: experimental
tags:
- attack.credential_access
- attack.t1208
- attack.t1558.003
ruletype: SIGMA
