Security ArtifactsDFIR Intelligence
SearchSign inSubscribe

ChecklistCONSTRUCTEDUntestedMembers

First 15 minutes: a burst of RC4 service ticket requests

One account asked the domain controller for RC4 tickets to several service accounts within a minute. Nothing failed, and that is the point. The cracking happens offline, so you act on the request, not on proof.

high severityCredential AccessT1558.003

The clock starts when

Event 4769 shows one account requesting service tickets with encryption type 0x17 (RC4) for several user-backed service accounts within a short window.

  1. minutes 0 to 5Confirm the burst3 lines, 1 where evidence expires
  2. minutes 5 to 10Make the tickets worthless3 lines
  3. minutes 10 to 15Look for use2 lines

sources

  1. MITRE ATT&CK T1558.003, Steal or Forge Kerberos Tickets: Kerberoasting · primary
  2. Microsoft Learn: 4769, A Kerberos service ticket was requested
  3. Microsoft Learn: group managed service accounts overview

Tags: first-15 · kerberos · kerberoasting · active-directory · service-accounts · T1558.003