Classification:

attack

Tactic:

TA0006-credential-access

Technique:

T1558-steal-or-forge-kerberos-tickets

VIEW RULE IN DATADOG VIEW SIGNALS

Goal

Detects when multiple Service Principle Names (SPN) are requested with weak encryption types. This could be evidence of a kerberoasting attack being conducted

Strategy

Monitoring of Windows event logs where @evt.id is 4769 and grouping by @Event.EventData.Data.TargetUserName.

Triage & Response

Verify if {{@Event.EventData.Data.TargetUserName}} is expected to request multiple SPN’s. If possible, disable usage of weak encryption types such as RC4 for kerberos tickets.

Changelog

• 24 September 2025 - Updated severity.