This note documents detection patterns related to Kerberoasting within Active Directory environments.

Direct Indicators

Indirect Indicators

Common Tools

Relevant Artifacts

• Domain controller Security log events: 4769 (primary), 4768 (context), 4624/4625 (follow-on), 4672 (privileged sessions), 4767/4771 (Kerberos failures)
• Microsoft-Windows-Kerberos-* operational logs (if enabled) for KDC processing context
• Host EDR telemetry: process tree, command line, module loads, network connections to DC:88
• Sysmon: 1 (process), 3 (net), 11 (file create), 7 (image load), 10 (process access) as environment-dependent
• Command-line auditing (4688 with command line) and PowerShell logs (4103/4104) if PowerShell used
• Prefetch (where applicable): execution proof for roast tooling binaries on endpoints
• Amcache/ShimCache: execution evidence and file path metadata
• MFT / USN Journal: creation of output files (hash dumps), archives, and staging directories
• Network telemetry: DC:88 spikes, proxy logs, VPN/VDI logs tying source IP to user/device
• AD object inventory: SPN-bearing accounts, encryption types supported, “Do not require Kerberos preauthentication” flags (for adjacent techniques)

MITRE ATT&CK References

• T1558.003 Kerberoasting
• T1558 Steal or Forge Kerberos Tickets
• T1110 Brute Force (offline cracking follow-on, contextual)
• T1078 Valid Accounts (post-crack usage)

Decision Tree

1. Is the suspicious event present?
   • Look for Security 4769 spikes (volume + diversity) and/or RC4-heavy TGS requests.
2. What host generated the event?
   • Use 4769 ClientAddress/IpAddress (and port) to identify the source system.
   • Pivot to endpoint telemetry for that host: Sysmon/EDR process execution around the same time.
3. Is the account expected to perform this action?
   • Validate whether the requesting AccountName is a service discovery/admin account or a normal user.
   • Compare against baseline: typical number of unique SPNs requested per day for this user/host.
4. Pivot:
   • Source host → process execution
     • Search for Rubeus/Impacket/PowerShell evidence (4688/Sysmon 1, PS 4104).
   • Account → privilege escalation
     • Did the account gain new group membership (4728/4732), privileges (4672), or perform admin actions?
   • Network → lateral movement
     • Post-roast, hunt for remote exec indicators (7045, 4698, Sysmon 3/1 patterns, PSRemoting logs).
5. Confirm scope and intent
   • Identify which ServiceName/SPNs were targeted and whether any correspond to privileged service accounts.
   • Check for subsequent logons by those service accounts (4624) from abnormal hosts.

Example Detection Templates

KQL

// Kerberoasting hunt: high unique SPN diversity per user+source within 5 minutes
// Data source: Windows Security Events (EventID 4769). Field names may vary by pipeline.
let window = 5m;
SecurityEvent
| where EventID == 4769
| extend User = tostring(TargetUserName), // sometimes AccountName/TargetUserName
         Service = tostring(ServiceName),
         Enc = tostring(TicketEncryptionType),
         SrcIp = coalesce(tostring(IpAddress), tostring(ClientAddress), tostring(IpPort)) // adapt to schema
| summarize
    TotalTGS = count(),
    UniqueSPNs = dcount(Service),
    UniqueServices = make_set(Service, 50),
    Enctypes = make_set(Enc, 10)
  by bin(TimeGenerated, window), User, SrcIp
| where UniqueSPNs >= 20 or TotalTGS >= 50
| order by UniqueSPNs desc, TotalTGS desc

// Kerberoasting suspicion: RC4-heavy TGS requests (0x17 / RC4) from a single user+source
let window = 10m;
SecurityEvent
| where EventID == 4769
| extend Enc = tostring(TicketEncryptionType),
         User = tostring(TargetUserName),
         SrcIp = coalesce(tostring(IpAddress), tostring(ClientAddress))
| where Enc has "0x17" or Enc has "RC4"
| summarize RC4TGS = count(), UniqueSPNs = dcount(tostring(ServiceName)) by bin(TimeGenerated, window), User, SrcIp
| where RC4TGS >= 10 and UniqueSPNs >= 5
| order by RC4TGS desc

// Correlation pivot: TGS burst + nearby suspicious process execution (Sysmon EventID 1)
// Requires normalized Sysmon table (e.g., EventID==1) and a join key (DeviceName/Computer + time window).
let tgsWindow = 5m;
let procWindow = 10m;
let TGS = SecurityEvent
| where EventID == 4769
| extend User = tostring(TargetUserName),
         SrcIp = coalesce(tostring(IpAddress), tostring(ClientAddress)),
         Service = tostring(ServiceName)
| summarize TotalTGS=count(), UniqueSPNs=dcount(Service) by bin(TimeGenerated, tgsWindow), User, SrcIp, Computer
| where UniqueSPNs >= 20;
let Procs = Sysmon
| where EventID == 1
| extend Image = tostring(Process), CommandLine = tostring(CommandLine)
| where CommandLine has_any ("kerberoast", "GetUserSPNs", "Rubeus", "PowerView", "Invoke-Kerberoast")
   or Image has_any ("rubeus", "GetUserSPNs", "powershell.exe", "pwsh.exe")
| project ProcTime=TimeGenerated, Computer, Image, CommandLine, ParentImage=tostring(ParentProcessName), User=tostring(UserName);
TGS
| join kind=leftouter (Procs) on Computer
| where ProcTime between (TimeGenerated - procWindow .. TimeGenerated + procWindow)
| project TimeGenerated, Computer, User, SrcIp, TotalTGS, UniqueSPNs, Image, CommandLine, ParentImage, ProcTime
| order by TimeGenerated desc

EQL

/* EQL (Elastic) idea: high-volume 4769 (Kerberos service ticket requests) from one user/source */
any where event.code == "4769"
| stats
    total = count(),
    unique_spn = cardinality(winlog.event_data.ServiceName),
    spns = values(winlog.event_data.ServiceName)
  by user.name, source.ip, date_trunc(5 minutes, @timestamp)
| where unique_spn >= 20 or total >= 50

/* Correlate a TGS burst with suspicious process execution on the same host (Sysmon EventID 1 as event.code "1" depending on ingestion) */
sequence by host.name with maxspan=10m
  [ any where event.code == "4769" and winlog.channel == "Security" ]
  [ process where
      (process.command_line like "*kerberoast*" or process.command_line like "*GetUserSPNs*" or process.command_line like "*Rubeus*"
       or process.name in ("powershell.exe","pwsh.exe") )
  ]

Sigma

title: Kerberoasting Suspected - High Diversity Kerberos TGS Requests
id: 7f2a2ef0-5e4b-4b5d-9c57-kerberoast-diversity
status: experimental
description: Detects potential Kerberoasting by identifying a single account requesting many distinct SPNs (TGS requests) in a short time window.
references:
  - https://attack.mitre.org/techniques/T1558/003/
author: Vergil
date: 2026-03-04
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4769
  timeframe: 5m
  condition: selection | count() by TargetUserName, IpAddress >= 50 or selection | count_distinct(ServiceName) by TargetUserName, IpAddress >= 20
fields:
  - TargetUserName
  - ServiceName
  - TicketEncryptionType
  - IpAddress
  - WorkstationName
falsepositives:
  - Service discovery tools used by administrators
  - Vulnerability scanners or monitoring systems that enumerate services
  - Citrix/VDI farms generating unusual Kerberos patterns (validate baseline)
level: high
tags:
  - attack.credential_access
  - attack.t1558.003

Splunk

Suspicious TGS Without Follow-Up Logon

index=main source="WinEventLog:Security" (EventCode=4648 OR EventCode=4769)  
| dedup RecordNumber  
| rex field=user "(?<username>[^@]+)"  
| search username!=*$  
| bin span=2m _time  
| stats values(EventCode) as Events values(service_name) as service_name values(Target_Server_Name) as Target_Server_Name by _time username  
| where match(Events,"4769") AND NOT match(Events,"4648")  
| sort _time

High Volume SPN Ticket Requests

index=main source="WinEventLog:Security" EventCode=4769  
| search service_name!="krbtgt"  
| rex field=user "(?<username>[^@]+)"  
| stats count dc(service_name) as UniqueSPNs values(service_name) as SPNs by username src_ip  
| where UniqueSPNs > 3  
| sort - count

Mitigation & Hardening