Kerberoasting

// T1558.003 Kerberoasting — RC4-Encrypted TGS Ticket Requests
// Detects Kerberos service ticket requests using RC4 encryption (etype 0x17)
// which are vulnerable to offline password cracking.
// Deploy on Domain Controllers — they generate Event 4769 for all TGS requests
let LookbackWindow = 1h;
let BulkSPNThreshold = 5;  // >= 5 unique SPNs in window indicates automated tooling
SecurityEvent
| where TimeGenerated > ago(LookbackWindow)
| where EventID == 4769                          // Kerberos Service Ticket Operations
| where TargetUserName !endswith "$"             // Exclude machine accounts (COMPUTER$)
| where ServiceName !~ "krbtgt"                  // Exclude TGT renewals
| where ServiceName !endswith "$"                // Exclude computer account service tickets
| where TicketEncryptionType == "0x17"           // RC4-HMAC — offline-crackable
| extend NormalizedSourceIP = replace_string(IpAddress, "::ffff:", "")
| summarize
    TGSRequestCount = count(),
    TargetSPNs = make_set(ServiceName, 200),
    UniqueServiceCount = dcount(ServiceName),
    FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated)
  by TargetUserName, NormalizedSourceIP, Computer
| extend IsBulkKerberoast = UniqueServiceCount >= BulkSPNThreshold
| extend AlertPriority = case(
    UniqueServiceCount >= 20, "Critical",
    UniqueServiceCount >= BulkSPNThreshold, "High",
    "Medium")
| project FirstSeen, LastSeen, Computer, TargetUserName, NormalizedSourceIP,
          TGSRequestCount, UniqueServiceCount, IsBulkKerberoast, AlertPriority, TargetSPNs
| sort by UniqueServiceCount desc, TGSRequestCount desc

index=wineventlog sourcetype="WinEventLog:Security" EventCode=4769
  NOT TargetUserName="*$"
  NOT ServiceName="*$"
  NOT ServiceName="krbtgt"
  TicketEncryptionType="0x17"
| eval NormalizedSourceIP=replace(IpAddress, "::ffff:", "")
| stats
    count as TGSRequestCount,
    dc(ServiceName) as UniqueServiceCount,
    values(ServiceName) as TargetSPNs,
    earliest(_time) as FirstSeen,
    latest(_time) as LastSeen
    by TargetUserName, NormalizedSourceIP, host
| eval IsBulkKerberoast=if(UniqueServiceCount >= 5, "true", "false")
| eval AlertPriority=case(
    UniqueServiceCount >= 20, "Critical",
    UniqueServiceCount >= 5, "High",
    1=1, "Medium")
| sort - UniqueServiceCount - TGSRequestCount
| table FirstSeen, LastSeen, host, TargetUserName, NormalizedSourceIP, TGSRequestCount, UniqueServiceCount, IsBulkKerberoast, AlertPriority, TargetSPNs

sequence by winlog.event_data.TargetUserName, source.ip with maxspan=1h
  [authentication where event.code == "4769"
   and winlog.event_data.TicketEncryptionType == "0x17"
   and not winlog.event_data.TargetUserName like~ "*$"
   and not winlog.event_data.ServiceName like~ "*$"
   and winlog.event_data.ServiceName != "krbtgt"] with runs=5

SELECT
  MIN(DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss')) AS FirstSeen,
  MAX(DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss')) AS LastSeen,
  LOGSOURCENAME(logsourceid) AS DomainController,
  username AS TargetUserName,
  sourceip AS SourceIP,
  COUNT(*) AS TGSRequestCount,
  COUNT(DISTINCT "Service Name") AS UniqueServiceCount,
  CASE
    WHEN COUNT(DISTINCT "Service Name") >= 20 THEN 'Critical'
    WHEN COUNT(DISTINCT "Service Name") >= 5 THEN 'High'
    ELSE 'Medium'
  END AS AlertPriority,
  CASE
    WHEN COUNT(DISTINCT "Service Name") >= 5 THEN 'true'
    ELSE 'false'
  END AS IsBulkKerberoast
FROM events
WHERE
  devicetype = 12
  AND eventid = 4769
  AND "Ticket Encryption Type" = '0x17'
  AND username NOT LIKE '%$'
  AND "Service Name" NOT LIKE '%$'
  AND "Service Name" != 'krbtgt'
  AND starttime > NOW() - 3600000
GROUP BY username, sourceip, logsourceid
HAVING COUNT(DISTINCT "Service Name") >= 1
ORDER BY UniqueServiceCount DESC, TGSRequestCount DESC

_sourceCategory=Windows/Security EventCode=4769
| json "TargetUserName" as TargetUserName nodrop
| json "ServiceName" as ServiceName nodrop
| json "TicketEncryptionType" as TicketEncryptionType nodrop
| json "IpAddress" as IpAddress nodrop
| where !isNull(TargetUserName) and !isNull(TicketEncryptionType)
| where TicketEncryptionType = "0x17"
| where !(TargetUserName matches "*$")
| where !(ServiceName matches "*$")
| where ServiceName != "krbtgt"
| replace(IpAddress, "::ffff:", "") as NormalizedSourceIP
| timeslice 1h
| count_distinct(ServiceName) as UniqueServiceCount, count as TGSRequestCount by TargetUserName, NormalizedSourceIP, _sourceHost, _timeslice
| where UniqueServiceCount >= 1
| if(UniqueServiceCount >= 5, "true", "false") as IsBulkKerberoast
| if(UniqueServiceCount >= 20, "Critical", if(UniqueServiceCount >= 5, "High", "Medium")) as AlertPriority
| fields - _timeslice
| sort by UniqueServiceCount desc, TGSRequestCount desc

rule t1558_003_kerberoasting_rc4_tgs_bulk {
  meta:
    author = "Detection Engineer"
    description = "Detects Kerberoasting — bulk RC4-encrypted TGS requests (Event 4769, etype 0x17) indicating automated SPN enumeration"
    mitre_attack_tactic = "Credential Access"
    mitre_attack_technique = "T1558.003"
    severity = "High"
    reference = "https://attack.mitre.org/techniques/T1558/003/"

  events:
    $e.metadata.product_event_type = "4769"
    not re.regex($e.principal.user.userid, `\$$`)
    not re.regex($e.target.resource.name, `\$$`)
    $e.target.resource.name != "krbtgt"
    $e.additional.fields["TicketEncryptionType"] = "0x17"
    $e.principal.user.userid = $user
    $e.principal.ip = $ip
    $e.target.resource.name = $spn

  match:
    $user, $ip over 1h

  outcome:
    $unique_spn_count = count_distinct($spn)
    $tgs_request_count = count($e)
    $alert_priority = if($unique_spn_count >= 20, "Critical",
                         if($unique_spn_count >= 5, "High", "Medium"))
    $is_bulk_kerberoast = ($unique_spn_count >= 5)

  condition:
    #e >= 5
}

EventID = "4769"
| TargetUserName != /\$$/
| ServiceName != /\$$/
| ServiceName != "krbtgt"
| TicketEncryptionType = "0x17"
| regex("::ffff:(?<CleanSourceIP>.*)", field=IpAddress, strict=false)
| IpAddress := if(isNull(CleanSourceIP), IpAddress, CleanSourceIP)
| groupBy([TargetUserName, IpAddress, ComputerName], function=[
    count(as=TGSRequestCount),
    count(ServiceName, distinct=true, as=UniqueServiceCount),
    collect(ServiceName, max=200, as=TargetSPNs),
    min(@timestamp, as=FirstSeen),
    max(@timestamp, as=LastSeen)
  ])
| IsBulkKerberoast := UniqueServiceCount >= 5
| case {
    UniqueServiceCount >= 20 | AlertPriority := "Critical" ;
    UniqueServiceCount >= 5  | AlertPriority := "High" ;
    *                        | AlertPriority := "Medium"
  }
| sort(UniqueServiceCount, order=desc)