Techniques › T1558.003 › AN0444
AN0444 Analytic 0444
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detects Kerberoasting attempts by monitoring for anomalous Kerberos TGS requests (Event ID 4769) with RC4 encryption (etype 0x17), accounts requesting an unusual number of service tickets in a short period, or service accounts targeted outside normal usage baselines. Also correlates suspicious process activity (e.g., Mimikatz invoking LSASS access) with Kerberos ticket anomalies.</p>
- Detects
- T1558.003 Kerberoasting
- Part of
- DET0157 Detect Kerberoasting Attempts (T1558.003)
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Security | EventCode=4769 | DC0084 Active Directory Credential Request |
| WinEventLog:Sysmon | EventCode=10 | DC0035 Process Access |
| WinEventLog:Security | EventCode=4624, 4648 | DC0067 Logon Session Creation |
| WinEventLog:Security | EventCode=4672 | DC0088 Logon Session Metadata |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
TGSRequestThreshold | Number of TGS requests per account within a defined window; higher than baseline may indicate Kerberoasting. |
AllowedEncryptionTypes | Permitted Kerberos encryption algorithms; RC4 (etype 0x17) usage in modern environments is suspicious. |
ServiceAccountBaselines | Expected SPNs requested by specific accounts; anomalies may indicate adversarial targeting. |
TimeWindow | Correlation window for bursts of TGS requests; adjustable to reduce false positives. |