LoFP / first-time or infrequent access to legacy services, cross-platform integrations, and inter-domain trust activity may legitimately establish a new requester-to-service relationship using rc4 encryption.

Techniques

• T1558

Sample rules

Newly Observed RC4 Kerberos Service Ticket Request

• source: elastic
• technicques:
  • T1558

Description

Identifies a successful RC4-HMAC Kerberos service ticket request for a requester and service pair that has not been observed during the previous 7 days. A newly observed requester-to-service relationship involving an RC4-encrypted ticket may indicate Kerberoasting.

Detection logic

host.os.type:windows and event.category:authentication and event.code:4769 and
  winlog.event_data.Status:0x0 and winlog.event_data.TicketEncryptionType:0x17 and
  winlog.event_data.TargetUserName:* and
  winlog.event_data.ServiceName:(* and not (krbtgt or *$)) and
  not (winlog.event_data.TargetUserName:*$@* and source.ip:(127.0.0.0/8 or "::1"))