T1558.003 — Kerberoasting

Tactic: Credential Access · Platforms: Windows

Adversaries may abuse a valid Kerberos ticket-granting ticket (TGT) or sniff network traffic to obtain a ticket-granting service (TGS) ticket that may be vulnerable to Brute Force. Service principal names (SPNs) are used to uniquely identify each instance of a Windows service. To enable…

Sub-technique of Steal or Forge Kerberos Tickets (T1558).

Sigma detection rules (1)

T1558.003 Steal or Forge Kerberos Tickets: Kerberoasting

title: "T1558.003 Steal or Forge Kerberos Tickets: Kerberoasting"
id: 38c2d394-3a83-4e85-9c17-a9299b10a382
description: 'Detect Kerberoasting Attempts (T1558.003) via Kerberos TGS-REQ/TGS-REP service ticket requests using weak RC4 encryption for non-machine service accounts. (Data Component: Kerberos Service Ticket Request; baseline tier: windows-eventid.) Tune using: TGSRequestThreshold, AllowedEncryptionTypes, ServiceAccountBaselines, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1558/003
author: Shahrukh Khan
date: 2026-04-25
license: MIT
tags:
  - attack.credential-access
  - attack.t1558.003

logsource:
  product: windows
  service: security

detection:
  selection:
    EventID: 4769
    TicketEncryptionType: '0x17'

  filter_machine_accounts:
    ServiceName|endswith: '
    
  



  condition: selection and not filter_machine_accounts

falsepositives:
  - Legacy applications or misconfigured service accounts that still negotiate RC4 instead of AES.

level: medium

Related sub-techniques

Explore