AS-REP roasting
A Kerberos authentication-service (TGT) request (Event ID 4768) for an account that does NOT require pre-authentication (Pre-Authentication Type 0x0).
What it detects
A Kerberos authentication-service (TGT) request (Event ID 4768) for an account that does NOT require pre-authentication (Pre-Authentication Type 0x0). Accounts with "Do not require Kerberos preauthentication" set can be "AS-REP roasted" — an attacker requests their encrypted TGT and cracks it offline for the password, with no valid credentials needed.
MITRE ATT&CK mapping
- T1558.004Steal or Forge Kerberos Tickets: AS-REP Roasting· Credential Access
False positives and triage
A few legacy or interop accounts legitimately disable pre-authentication. The signal is TGT requests for such accounts from an unexpected source, or several distinct no-preauth accounts requested together. Audit which accounts have pre-authentication disabled — very few should.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 70%. Source: rules/windows/asrep_roasting.yaml, licensed under the Apache License 2.0.
id: windows.credential.asrep_roasting
version: 1.0.0
status: stable
severity: high
confidence: 0.7
platforms: [windows]
mitre_techniques: [T1558.004]
description: |
A Kerberos authentication-service (TGT) request (Event ID 4768) for an account
that does NOT require pre-authentication (Pre-Authentication Type 0x0). Accounts
with "Do not require Kerberos preauthentication" set can be "AS-REP roasted" —
an attacker requests their encrypted TGT and cracks it offline for the password,
with no valid credentials needed.
match:
native_event_id: 4768
raw_message_contains_any:
- "Pre-Authentication Type: 0x0"
- "Pre-Authentication Type:\t0x0"
- "Preauthentication Type: 0x0"
correlation_keys: [user_name]
false_positive_guidance: |
A few legacy or interop accounts legitimately disable pre-authentication. The
signal is TGT requests for such accounts from an unexpected source, or several
distinct no-preauth accounts requested together. Audit which accounts have
pre-authentication disabled — very few should.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.