Kerberoasting SPN sweep
One account requesting RC4-HMAC (Ticket Encryption Type 0x17) Kerberos service tickets (Event ID 4769) for many DISTINCT services in a short window.
What it detects
One account requesting RC4-HMAC (Ticket Encryption Type 0x17) Kerberos service tickets (Event ID 4769) for many DISTINCT services in a short window. This is the low-and-slow companion to windows.credential.kerberoasting: that rule keys on VOLUME (a burst of RC4 requests), which a careful attacker evades by requesting each ticket once. Roasting is fundamentally about BREADTH — pulling crackable tickets for as many service accounts as possible — so counting DISTINCT services requested by one account (rather than raw volume) catches the sweep even at one request per SPN. Realises a catalogued behaviour (distinct-count spike).
MITRE ATT&CK mapping
- T1558.003Steal or Forge Kerberos Tickets: Kerberoasting· Credential Access
False positives and triage
A vulnerability scanner or an account-discovery tool run by IT can also request tickets for many services. The signal is one account pulling RC4 (0x17) tickets for several DISTINCT service accounts in a short window when AES is otherwise standard in the domain. Confirm the requesting account is not a scanner/service-desk tool, and whether those SPNs map to high-value service accounts.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 75%. Source: rules/windows/kerberoasting_spn_sweep.yaml, licensed under the Apache License 2.0.
id: windows.credential.kerberoasting_spn_sweep
version: 1.0.0
status: stable
severity: high
confidence: 0.75
platforms: [windows]
mitre_techniques: [T1558.003]
description: |
One account requesting RC4-HMAC (Ticket Encryption Type 0x17) Kerberos service tickets
(Event ID 4769) for many DISTINCT services in a short window. This is the low-and-slow
companion to windows.credential.kerberoasting: that rule keys on VOLUME (a burst of RC4
requests), which a careful attacker evades by requesting each ticket once. Roasting is
fundamentally about BREADTH — pulling crackable tickets for as many service accounts as
possible — so counting DISTINCT services requested by one account (rather than raw
volume) catches the sweep even at one request per SPN. Realises behavioural catalog
BEH-075 (distinct-count spike).
match:
native_event_id: 4769
raw_message_contains_any:
- "0x17"
threshold:
count: 5
window_seconds: 600
group_by: [user_name]
distinct: service_name
correlation_keys: [user_name]
false_positive_guidance: |
A vulnerability scanner or an account-discovery tool run by IT can also request tickets
for many services. The signal is one account pulling RC4 (0x17) tickets for several
DISTINCT service accounts in a short window when AES is otherwise standard in the domain.
Confirm the requesting account is not a scanner/service-desk tool, and whether those SPNs
map to high-value service accounts.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.