win:security 4769
A Kerberos service ticket was requested.
- Log source
- Windows Security event log
- Host type
- Windows (workstation, member server, domain controller)
- How to enable
- Advanced Audit Policy: Account Logon > Audit Kerberos Service Ticket Operations
- Audit category
- Account Logon
- Audit subcategory
- Audit Kerberos Service Ticket Operations
- Tier, host type
- Minimum
- Techniques
- 6
- Rules depending on it
- Splunk 6, Sigma 3, Elastic 3, Microsoft Sentinel 1
Why this tier
Microsoft audit baseline (dc); NSA
By role
| Role | Tier | Basis |
|---|---|---|
| Windows domain controller | Minimum | Microsoft audit baseline (dc); NSA |
Techniques it helps detect
Rules that depend on it
Splunk 6
- Kerberoasting spn request with RC4 encryption
- Kerberos Service Ticket Request Using RC4 Encryption
- Suspicious Kerberos Service Ticket Request
- Unusual Number of Computer Service Tickets Requested
- Unusual Number of Kerberos Service Tickets Requested
- Windows Large Number of Computer Service Tickets Requested
Sigma 3
- Kerberoasting Activity - Initial Query by @kostastsale
- Kerberos Manipulation by Florian Roth (Nextron Systems)
- Suspicious Kerberos RC4 Ticket Encryption by Florian Roth (Nextron Systems)
Elastic 3
Microsoft Sentinel 1
Standards and guidance naming it
| Requirement | Relation | Basis |
|---|---|---|
| OMB M-26-14: Attack vectors and lateral movementAppendix B item 5(10) | Supports an activity | our analysis: Kerberos service tickets |
| NSA: Recommended Windows events to forwardEvent Forwarding Guidance (RecommendedEvents.csv) | Names this event | Network Policy: Kerberos Service Ticket Req. Failed |
| Microsoft: Events to monitor with potential criticalityAppendix L: Events to Monitor (Windows Server AD DS best practices) | Names this event | potential criticality Low: A Kerberos service ticket was requested. |