4768 Security log · Kerberos Authentication Service medium severity high volume

Windows Event ID 4768 — A Kerberos authentication ticket (TGT) was requested

Kerberos TGT requested from a DC. Key fields: AccountName, ClientAddress, TicketOptions, Status, EncryptionType (0x17=RC4, 0x12=AES256, 0x11=AES128).

Why event 4768 matters

Golden Ticket abuse generates 4768 with RC4 encryption (0x17) from unexpected hosts in AES-enabled environments. AS-REP Roasting targets accounts with DONT_REQUIRE_PREAUTH — Status=0x0 with no pre-auth. Clock skew status (0x25) indicates time manipulation for replay protection bypass.

How to detect it

Alert: EncryptionType=0x17 from non-legacy hosts in modern AD. Alert: Status 0x6 (bad username), 0x12 (account disabled), 0x18 (bad password), 0x25 (clock skew — replay protection). Alert: TGT for service accounts from unexpected IPs.

Log source
Security
Advanced Audit Policy — enable the 'Kerberos Authentication Service' subcategory (Success and/or Failure).
Fields to pivot on
TargetUserNameIpAddressTicketEncryptionTypeTicketOptionsStatus

MITRE ATT&CK mapping

Tactic Technique
Credential Access Golden Ticket (T1558.001)
Credential Access AS-REP Roasting (T1558.004)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sigma rule
title: Kerberos TGT Request with RC4 Encryption
status: experimental
description: RC4 TGT request in modern environment may indicate golden ticket or downgrade
author: theadminstack.com
date: 2026/05/16
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4768
        TicketEncryptionType: '0x17'
        Status: '0x0'
    filter_computers:
        AccountName|endswith: '$'
    condition: selection and not filter_computers
falsepositives:
    - Legacy systems requiring RC4
level: medium
tags:
    - attack.credential_access
    - attack.t1558.001
    - attack.t1558.004
Sentinel / Defender KQL
SecurityEvent
| where EventID == 4768   // A Kerberos authentication ticket (TGT) was requested
| project TimeGenerated, Computer, TargetUserName, IpAddress, TicketEncryptionType, TicketOptions, Status
| sort by TimeGenerated desc
Splunk SPL
index=* sourcetype="WinEventLog:Security" EventCode=4768
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# A Kerberos authentication ticket (TGT) was requested — add EventData fields: TargetUserName, IpAddress, TicketEncryptionType, TicketOptions`
Hunt event 4768 in Sentinel/Defender →
Build a KQL query for this event in the KQL Query Builder.
Search all event IDs →
Open the interactive Windows Event ID lookup.

Related Kerberos Authentication Service events

4769 A Kerberos service ticket was requested 4770 A Kerberos service ticket was renewed 4771 Kerberos pre-authentication failed 4772 A Kerberos authentication ticket request failed 4773 A Kerberos service ticket request failed 4774 An account was mapped for logon 4775 An account could not be mapped for logon 4776 The domain controller attempted to validate the credentials for an account (NTLM) 4777 The domain controller failed to validate the credentials for an account 4820 A Kerberos Ticket-Granting-Ticket (TGT) was denied because the device does not meet the access control restrictions 4821 A Kerberos service ticket was denied because the user, device, or both do not meet the access control restrictions 4822 NTLM authentication failed because the account was a member of the Protected Users group

Frequently asked questions

What is Windows Event ID 4768?

A Kerberos authentication ticket (TGT) was requested. Kerberos TGT requested from a DC. Key fields: AccountName, ClientAddress, TicketOptions, Status, EncryptionType (0x17=RC4, 0x12=AES256, 0x11=AES128).

Which log records event 4768?

Event 4768 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Kerberos Authentication Service' subcategory (Success and/or Failure).

What MITRE ATT&CK techniques map to event 4768?

Event 4768 is associated with: Golden Ticket (T1558.001), AS-REP Roasting (T1558.004).

How do you detect activity around event 4768?

Alert: EncryptionType=0x17 from non-legacy hosts in modern AD. Alert: Status 0x6 (bad username), 0x12 (account disabled), 0x18 (bad password), 0x25 (clock skew — replay protection). Alert: TGT for service accounts from unexpected IPs.