Skip to main content
AD Academy
Back to all events
4769Security (DC)AuthenticationWARNLast updated:

Service ticket (TGS) requested — the Kerberoasting signal

What it means

A user requested a ticket for a service. Many RC4 (0x17) requests from one user to many services signal Kerberoasting.

When it is normal and when it is suspicious

Normal: hundreds a day — every file-server access issues a ticket. Suspicious: RC4 requests for many different SPNs from one account within minutes (Kerberoasting).

First steps

  1. 1Alert on one Account Name requesting 10+ distinct services in 10 minutes.
  2. 2Review which service accounts have SPNs and how strong their passwords are.
  3. 3Move service accounts to gMSA to close the vector.

Fields worth checking

FieldWhat to look at
Service NameThe requested SPN. Many distinct SPNs in one minute suggests Kerberoasting.
Ticket Encryption Type0x17 = RC4, crackable offline. 0x12 = AES, much safer.

Related events

This reference is a starting point for investigation, not a replacement for your organisation's security policy.