{"id":"b1e0b3f5-b62e-41be-886a-daffde446ad4","title":"No Suitable Encryption Key Found For Generating Kerberos Ticket","description":"Detects errors when a target server doesn't have suitable keys for generating kerberos tickets.\nThis issue can occur for example when a service uses a user account or a computer account that is configured for only DES encryption on a computer that is running Windows 7 which has DES encryption for Kerberos authentication disabled.\n","author":"@SerkinValery","status":"test","level":"low","date":"2024-03-07","modified":"2025-09-22","tags":["attack.credential-access","attack.t1558.003"],"technique_ids":["T1558.003"],"logsource":{"product":"windows","service":"system"},"falsepositives":["Unknown"],"references":["https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd348773(v=ws.10)","https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/kdc-event-16-27-des-encryption-disabled"],"source_path":"rules/windows/builtin/system/microsoft_windows_kerberos_key_distribution_center/win_system_kdcsvc_tgs_no_suitable_encryption_key_found.yml","source_sha256":"6a9a3ec9843b2eedea598571c11fa2deacf2abd89435543625ca8ab453cdafb3","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/system/microsoft_windows_kerberos_key_distribution_center/win_system_kdcsvc_tgs_no_suitable_encryption_key_found.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: No Suitable Encryption Key Found For Generating Kerberos Ticket\nid: b1e0b3f5-b62e-41be-886a-daffde446ad4\nstatus: test\ndescription: |\n    Detects errors when a target server doesn't have suitable keys for generating kerberos tickets.\n    This issue can occur for example when a service uses a user account or a computer account that is configured for only DES encryption on a computer that is running Windows 7 which has DES encryption for Kerberos authentication disabled.\nreferences:\n    - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd348773(v=ws.10)\n    - https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/kdc-event-16-27-des-encryption-disabled\nauthor: '@SerkinValery'\ndate: 2024-03-07\nmodified: 2025-09-22\ntags:\n    - attack.credential-access\n    - attack.t1558.003\nlogsource:\n    product: windows\n    service: system\ndetection:\n    selection:\n        Provider_Name:\n            - 'Kerberos-Key-Distribution-Center'\n            - 'Microsoft-Windows-Kerberos-Key-Distribution-Center'\n        EventID:\n            - 16 # KDCEVENT_NO_KEY_INTERSECTION_TGS\n            - 27 # KDCEVENT_UNSUPPORTED_ETYPE_REQUEST_TGS\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: low\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1558.003","id":"T1558.003","name":"Kerberoasting","page":"techniques/enterprise/T1558.003/"}],"data_path":"data/detection-rules/b1e0b3f5-b62e-41be-886a-daffde446ad4.json","kind":"sigma"}