Kerberos Service Ticket Request Using RC4 Encryption

This analytic detects Kerberos service ticket requests that utilize RC4 encryption, specifically by monitoring Kerberos Event 4769. The presence of RC4 encryption in these requests is a strong indicator of potential Golden Ticket attacks. In such attacks, adversaries forge Kerberos Granting Tickets (TGTs) using the NTLM password hash of the Krbtgt account to gain unauthorized and unrestricted access within an Active Directory environment. RC4 encryption is considered rare in modern networks, making its appearance in Kerberos service ticket requests highly suspicious and indicative of malicious activity. If confirmed, this activity could lead to lateral movement and remote code execution, compromising the entire network. It's important to note that this detection method might be bypassed if attackers opt to use an AES key instead of the NTLM hash for ticket forging.