Suspicious Kerberos RC4 Service Ticket Request
Detects service ticket requests using the weak RC4 encryption type (0x17) for Kerberos, which is often abused in Kerberoasting attacks. The rule specifically looks for Event ID 4769 (A Kerberos service ticket was granted) where the TicketOptions indicate a forwardable and renewable ticket, and the TicketEncryptionType is RC4. It attempts to reduce false positives by excluding service names ending with a dollar sign, which are typically machine accounts.
Sigma
