Windows vulnerable spn enumerated
このページは日本語には対応しておりません。随時翻訳に取り組んでいます。
翻訳に関してご質問やご意見ございましたら、
お気軽にご連絡ください。
Goal
Detects when multiple Service Principle Names (SPN) are requested with weak encryption types. This could be evidence of a kerberoasting attack being conducted
Strategy
Monitoring of Windows event logs where @evt.id is 4769 and grouping by @Event.EventData.Data.TargetUserName.
Triage & Response
Verify if {{@Event.EventData.Data.TargetUserName}} is expected to request multiple SPN’s. If possible, disable usage of weak encryption types such as RC4 for kerberos tickets.
Changelog
- 24 September 2025 - Updated severity.
