{"id":"d04ae2b8-ad54-4de0-bd87-4bc1da66aa59","title":"Kerberoasting Activity - Initial Query","description":"This rule will collect the data needed to start looking into possible kerberoasting activity.\nFurther analysis or computation within the query is needed focusing on requests from one specific host/IP towards multiple service names within a time period of 5 seconds.\nYou can then set a threshold for the number of requests and time between the requests to turn this into an alert.\n","author":"@kostastsale","status":"test","level":"medium","date":"2022-01-21","modified":"2025-10-19","tags":["attack.credential-access","attack.t1558.003"],"technique_ids":["T1558.003"],"logsource":{"product":"windows","service":"security"},"falsepositives":["Legacy applications."],"references":["https://www.trustedsec.com/blog/art_of_kerberoast/","https://adsecurity.org/?p=3513"],"source_path":"rules/windows/builtin/security/win_security_kerberoasting_activity.yml","source_sha256":"cec0c81991d59e93a2acefefbea2fd3a0efec40e9c93acaa882c17b6dbbf641b","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_kerberoasting_activity.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Kerberoasting Activity - Initial Query\nid: d04ae2b8-ad54-4de0-bd87-4bc1da66aa59\nstatus: test\ndescription: |\n    This rule will collect the data needed to start looking into possible kerberoasting activity.\n    Further analysis or computation within the query is needed focusing on requests from one specific host/IP towards multiple service names within a time period of 5 seconds.\n    You can then set a threshold for the number of requests and time between the requests to turn this into an alert.\nreferences:\n    - https://www.trustedsec.com/blog/art_of_kerberoast/\n    - https://adsecurity.org/?p=3513\nauthor: '@kostastsale'\ndate: 2022-01-21\nmodified: 2025-10-19\ntags:\n    - attack.credential-access\n    - attack.t1558.003\nlogsource:\n    product: windows\n    service: security\ndetection:\n    selection:\n        EventID: 4769\n        Status: '0x0' # Translated as status from failure code field. Query only for successes\n        TicketEncryptionType: '0x17' # RC4 ticket encryption type\n    filter_main_krbtgt:\n        ServiceName|endswith:\n            - 'krbtgt' # Ignore requests for the krbtgt service\n            - '$' # Ignore requests from service names that end with $ which are associated with genuine kerberos traffic\n    filter_main_machine_accounts:\n        TargetUserName|contains: '$@' # Ignore requests from machines\n    condition: selection and not 1 of filter_main_*\nfalsepositives:\n    - Legacy applications.\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1558.003","id":"T1558.003","name":"Kerberoasting","page":"techniques/enterprise/T1558.003/"}],"data_path":"data/detection-rules/d04ae2b8-ad54-4de0-bd87-4bc1da66aa59.json","kind":"sigma"}