Detection rules › Sigma
Suspicious Kerberos RC4 Ticket Encryption
Detects service ticket requests using RC4 encryption type
Known false positives
- Service accounts used on legacy systems (e.g. NetApp)
- Windows Domains with DFL 2003 and legacy systems
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Credential Access |
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Security-Auditing | Event ID 4769: A Kerberos service ticket was requested. |
Rule body
title: Suspicious Kerberos RC4 Ticket Encryption
id: 496a0e47-0a33-4dca-b009-9e6ca3591f39
status: test
description: Detects service ticket requests using RC4 encryption type
references:
- https://adsecurity.org/?p=3458
- https://www.trimarcsecurity.com/single-post/TrimarcResearch/Detecting-Kerberoasting-Activity
author: Florian Roth (Nextron Systems)
date: 2017-02-06
modified: 2022-06-19
tags:
- attack.credential-access
- attack.t1558.003
logsource:
product: windows
service: security
detection:
selection:
EventID: 4769
TicketOptions: '0x40810000'
TicketEncryptionType: '0x17'
reduction:
ServiceName|endswith: '$'
condition: selection and not reduction
falsepositives:
- Service accounts used on legacy systems (e.g. NetApp)
- Windows Domains with DFL 2003 and legacy systems
level: medium
Stages and Predicates
Stage 0: condition
selection and not reductionStage 1: selection
selection:
EventID: 4769
TicketOptions: '0x40810000'
TicketEncryptionType: '0x17'
Stage 2: not reduction
reduction:
ServiceName|endswith: '$'
Exclusions
The rule actively suppresses these predicates.
| Field | Kind | Excluded values | Search |
|---|---|---|---|
ServiceName | ends_with | $ | excludes:ServiceName field:"ServiceName" value:"$" |
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
TicketEncryptionType | eq |
| field:"TicketEncryptionType" kind:eq value:"0x17" |
TicketOptions | eq |
| field:"TicketOptions" kind:eq value:"0x40810000" |