Kerberos Golden/Silver Ticket Indicators via RC4 Downgrade & Ticket Anomalies

Ibrahim Saud@tektrix

•updated 6 days ago•0•0•0

Detects Kerberos TGS requests using RC4 encryption (0x17), which is a common indicator of Kerberoasting. By monitoring Event IDs 4768 and 4769 for this specific encryption type, this rule identifies potential attempts to offline-crack service account passwords.