Detection rules › Splunk
Kerberos TGT Request Using RC4 Encryption
The following analytic detects a Kerberos Ticket Granting Ticket (TGT) request using RC4-HMAC encryption (type 0x17) by leveraging Event 4768. This encryption type is outdated and its presence may indicate an OverPass The Hash attack. Monitoring this activity is crucial as it can signify credential theft, allowing adversaries to authenticate to the Kerberos Distribution Center (KDC) using a stolen NTLM hash. If confirmed malicious, this could enable unauthorized access to systems and resources, potentially leading to lateral movement and further compromise within the network.
Known false positives
- Based on Microsoft documentation, legacy systems or applications will use RC4-HMAC as the default encryption for TGT requests. Specifically, systems before Windows Server 2008 and Windows Vista. Newer systems will use AES128 or AES256.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Lateral Movement |
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Security-Auditing | Event ID 4768: A Kerberos authentication ticket (TGT) was requested. |
Rule body
name: Kerberos TGT Request Using RC4 Encryption
id: 18916468-9c04-11ec-bdc6-acde48001122
version: 12
creation_date: '2022-03-08'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects a Kerberos Ticket Granting Ticket (TGT) request using RC4-HMAC encryption (type 0x17) by leveraging Event 4768. This encryption type is outdated and its presence may indicate an OverPass The Hash attack. Monitoring this activity is crucial as it can signify credential theft, allowing adversaries to authenticate to the Kerberos Distribution Center (KDC) using a stolen NTLM hash. If confirmed malicious, this could enable unauthorized access to systems and resources, potentially leading to lateral movement and further compromise within the network.
data_source:
- Windows Event Log Security 4768
search: |-
`wineventlog_security` EventCode=4768 TicketEncryptionType=0x17 ServiceName!=*$
| stats count min(_time) as firstTime max(_time) as lastTime
BY ServiceName src_ip dest
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `kerberos_tgt_request_using_rc4_encryption_filter`
how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
known_false_positives: Based on Microsoft documentation, legacy systems or applications will use RC4-HMAC as the default encryption for TGT requests. Specifically, systems before Windows Server 2008 and Windows Vista. Newer systems will use AES128 or AES256.
references:
- https://stealthbits.com/blog/how-to-detect-overpass-the-hash-attacks/
- https://www.thehacker.recipes/ad/movement/kerberos/ptk
- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4768
finding:
title: A Kerberos TGT request with RC4 encryption was requested for $ServiceName$ from $src_ip$
entity:
field: src_ip
type: system
score: 50
analytic_story:
- Active Directory Kerberos Attacks
- Scattered Lapsus$ Hunters
asset_type: Endpoint
mitre_attack_id:
- T1550
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
category: endpoint
security_domain: endpoint
Stages and Predicates
Stage 1: search
`wineventlog_security` EventCode=4768 TicketEncryptionType=0x17 ServiceName!=*$
Stage 2: stats
| stats count min(_time) as firstTime max(_time) as lastTime
BY ServiceName src_ip dest
Stage 3: search
| `security_content_ctime(firstTime)`
Stage 4: search
| `security_content_ctime(lastTime)`
Stage 5: search
| `kerberos_tgt_request_using_rc4_encryption_filter`
Indicators
These rows show field, operator, and value matches.