Kerberos TGT request failed (authentication failure). Distinguishes from 4771 in specific failure scenarios.
Similar to 4771 context but for specific failure codes. See 4771 for main brute force detection.
Correlate with 4771 for comprehensive Kerberos failure monitoring.
SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName Starting points — adapt the log source, projected fields and thresholds for your environment.
SecurityEvent
| where EventID == 4772 // A Kerberos authentication ticket request failed
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated descindex=* sourcetype="WinEventLog:Security" EventCode=4772
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count `# A Kerberos authentication ticket request failed — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`A Kerberos authentication ticket request failed. Kerberos TGT request failed (authentication failure). Distinguishes from 4771 in specific failure scenarios.
Event 4772 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Kerberos Authentication Service' subcategory (Success and/or Failure).
Correlate with 4771 for comprehensive Kerberos failure monitoring.