Kerberoasting: Burst of RC4 Kerberos TGS-REQ (etype 0x17)

Ankit Mehta@Secvyn

•updated 6 days ago•0•0•0

Detects a burst of Kerberos TGS-REQ (Ticket-Granting Service Request) messages using RC4 encryption (etype 0x17) over UDP or TCP port 88. A high volume of these requests from a single source within a short timeframe is indicative of Kerberoasting, a technique where an attacker requests service tickets to perform offline password cracking of service account credentials.