Hunting for Kerberoasting Attacks via Kerberos Service Ticket Requests (Event ID 4769)

Kerberoasting is an effective lateral movement technique against Active Directory environments. Any domain user can request a Kerberos Ticket Granting Service (TGS) ticket for any service associated with a Service Principal Name (SPN). Adversaries extract these tickets and crack them offline to recover plaintext service account passwords.

To detect Kerberoasting, we look for anomalous request volumes requesting weak RC4 (0x17) encryption.

Required Data Collection

• Windows Domain Controllers forwarding Security Logs with Audit Kerberos Service Ticket Operations enabled.
• Log Analytics Table: SecurityEvent.

Kerberoasting KQL Detection Query

// Detect Anomalous Kerberos TGS Requests with Weak RC4 Encryption (0x17)
let timeWindow = 1h;
let ticketThreshold = 5;
SecurityEvent
| where TimeGenerated >= ago(timeWindow)
| where EventID == 4769
// 0x17 is RC4-HMAC (vulnerable to offline dictionary cracking)
| where TicketEncryptionType == "0x17"
// Exclude computer accounts (ending with $) which frequently request tickets legitimately
| where not(TargetUserName endswith "$") and not(ServiceName endswith "$")
// Filter out krbtgt requests
| where ServiceName != "krbtgt"
| summarize 
    RequestedServices = make_set(ServiceName, 20),
    ServiceCount = dcount(ServiceName),
    TicketCount = count(),
    StartTime = min(TimeGenerated),
    EndTime = max(TimeGenerated)
    by Computer, TargetUserName, IpAddress
| where ServiceCount >= ticketThreshold
| extend AttackDurationSec = datetime_diff('second', EndTime, StartTime)
| project Computer, TargetUserName, IpAddress, ServiceCount, TicketCount, AttackDurationSec, RequestedServices
| order by ServiceCount desc

Technical Indicators

1. TicketEncryptionType == "0x17": Modern Windows environments natively request AES-128 (0x12) or AES-256 (0x13). Automated Kerberoasting tools (e.g., Rubeus, Impacket) downgrade requests to RC4 to speed up hashcat cracking.
2. Exclusion of $ Accounts: Machine-to-machine Kerberos auth generates noise; filtering out names ending with $ drastically reduces false positives.
3. Thresholding on Distinct Services: Legitimate users access 1 or 2 enterprise services. Kerberoasting scripts query all registered SPNs within seconds.

Remediation & Hardening

• Migrate sensitive service accounts to Group Managed Service Accounts (gMSA) with auto-rotating 128-character passwords.
• Enforce AES encryption on existing domain service accounts and disable RC4.

MITRE ATT&CK Mapping

• Tactic: Credential Access (TA0006)
• Technique: Steal or Forge Kerberos Tickets: Kerberoasting (T1558.003)