skills.rest
YukiIto1999
YukiIto1999COMMUNITY
Explore all skills by this author →
GitHub

detecting-kerberoasting-attacks

Detect Kerberoasting indicators from Windows Event 4769 and 4624 logs.

Updated Apr 23, 2026
Search Tags:#forensics#incident-response#threat-hunting#windows-logs#kerberoasting#tgs#evtx
One-click install
npx skills add https://github.com/YukiIto1999/ctf-sleuth --skill detecting-kerberoasting-attacks
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: detecting-kerberoasting-attacks
Source: https://github.com/YukiIto1999/ctf-sleuth/tree/main/.claude/skills/detecting-kerberoasting-attacks
Command: npx skills add https://github.com/YukiIto1999/ctf-sleuth --skill detecting-kerberoasting-attacks

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires python-evtx, lxml, and includes scripts (resource) and references (resource) components.

What problem does it solve?

Kerberoasting is a credential theft technique that targets service accounts by abusing Kerberos ticket requests. This Skill provides detection logic to identify RC4-based TGS requests, anomalous SPN usage, and high-volume SPN requests with logon correlation to attribute activity.

Core Features & Use Cases

  • Detect RC4-based Kerberos TGS requests (TicketEncryptionType 0x17/0x18) targeting non-machine SPNs.
  • Identify high-volume TGS spray patterns from a single source by tracking unique target SPNs over time.
  • Correlate Kerberos events (4769) with logon events (4624) to support attacker attribution and incident investigation.
  • Produce structured output suitable for security analytics and incident response reporting.

Quick Start

Load a Windows Security EVTX collection and run the Kerberoasting detection workflow to produce findings.

Frequently Asked Questions about detecting-kerberoasting-attacks

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect Kerberoasting attacks in Windows EVTX logs?▼

To detect Kerberoasting in Windows EVTX logs, analyze Event 4769 Kerberos TGS requests for RC4-based encryption targeting non-machine SPNs. This process identifies anomalous SPN usage and high-volume TGS spray patterns from a single source.

Can I use this detection logic with my SIEM or data lake telemetry?▼

This detection logic works with a SIEM or data lake by feeding Windows security telemetry into the pipeline. It requires Event 4769 and 4624 logs, along with Sysmon-like visibility, to process and identify Kerberoasting indicators.

How do I identify high-volume TGS spray patterns from a single source?▼

Identify high-volume TGS spray patterns by tracking unique target SPNs requested over time from a single source within Event 4769 logs. This reveals attackers attempting to extract service account credentials by requesting many tickets.

What Windows Event IDs are required to attribute Kerberoasting activity?▼

Attributing Kerberoasting activity requires Windows Event ID 4769 for Kerberos TGS requests and Event ID 4624 for logon events. Correlating these events links the ticket requests to specific authenticated sessions for attacker attribution.

Why focus on RC4-based TGS requests when investigating Kerberoasting?▼

Focusing on RC4-based TGS requests is critical because Kerberoasting targets RC4 encryption types like 0x17 and 0x18 for offline cracking. Detecting these requests for non-machine SPNs highlights service accounts actively targeted by attackers.

Related Skills

Explore More Data & Analytics Skills→
OpenTideHQOpenTideHQ
4

windows-event-logs

Document Windows-native telemetry sources and audit policy prerequisites for detection engineering.

Official
Advanced
HikaruEgashiraHikaruEgashira
1

incident-handling

Automate incident response from detection through post-incident analysis.

Community
Advanced
YukiIto1999YukiIto1999

performing-kerberoasting-attack

Enumerate Kerberoastable SPN accounts and collect TGS ticket hashes for offline cracking.

Community
Advanced
YukiIto1999YukiIto1999

performing-network-traffic-analysis-with-zeek

Deploy Zeek to collect, parse, and analyze network traffic logs.

Community
Advanced