Kerberos TGT requested from a DC. Key fields: AccountName, ClientAddress, TicketOptions, Status, EncryptionType (0x17=RC4, 0x12=AES256, 0x11=AES128).
Golden Ticket abuse generates 4768 with RC4 encryption (0x17) from unexpected hosts in AES-enabled environments. AS-REP Roasting targets accounts with DONT_REQUIRE_PREAUTH — Status=0x0 with no pre-auth. Clock skew status (0x25) indicates time manipulation for replay protection bypass.
Alert: EncryptionType=0x17 from non-legacy hosts in modern AD. Alert: Status 0x6 (bad username), 0x12 (account disabled), 0x18 (bad password), 0x25 (clock skew — replay protection). Alert: TGT for service accounts from unexpected IPs.
TargetUserNameIpAddressTicketEncryptionTypeTicketOptionsStatus | Tactic | Technique |
|---|---|
| Credential Access | Golden Ticket (T1558.001) |
| Credential Access | AS-REP Roasting (T1558.004) |
Starting points — adapt the log source, projected fields and thresholds for your environment.
title: Kerberos TGT Request with RC4 Encryption
status: experimental
description: RC4 TGT request in modern environment may indicate golden ticket or downgrade
author: theadminstack.com
date: 2026/05/16
logsource:
product: windows
service: security
detection:
selection:
EventID: 4768
TicketEncryptionType: '0x17'
Status: '0x0'
filter_computers:
AccountName|endswith: '$'
condition: selection and not filter_computers
falsepositives:
- Legacy systems requiring RC4
level: medium
tags:
- attack.credential_access
- attack.t1558.001
- attack.t1558.004
SecurityEvent
| where EventID == 4768 // A Kerberos authentication ticket (TGT) was requested
| project TimeGenerated, Computer, TargetUserName, IpAddress, TicketEncryptionType, TicketOptions, Status
| sort by TimeGenerated desc
index=* sourcetype="WinEventLog:Security" EventCode=4768
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count `# A Kerberos authentication ticket (TGT) was requested — add EventData fields: TargetUserName, IpAddress, TicketEncryptionType, TicketOptions`
A Kerberos authentication ticket (TGT) was requested. Kerberos TGT requested from a DC. Key fields: AccountName, ClientAddress, TicketOptions, Status, EncryptionType (0x17=RC4, 0x12=AES256, 0x11=AES128).
Event 4768 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Kerberos Authentication Service' subcategory (Success and/or Failure).
Event 4768 is associated with: Golden Ticket (T1558.001), AS-REP Roasting (T1558.004).
Alert: EncryptionType=0x17 from non-legacy hosts in modern AD. Alert: Status 0x6 (bad username), 0x12 (account disabled), 0x18 (bad password), 0x25 (clock skew — replay protection). Alert: TGT for service accounts from unexpected IPs.