title: Kerberoasting - High Volume of Distinct SPN Requests
id: 1c9d4b77-2e55-4f01-bb3a-6d8e9f0a1b22
status: experimental
description: >
    A single account requested Kerberos service tickets (4769) for an
    unusually large number of distinct service principals in a short
    window - consistent with bulk Kerberoasting enumeration.
references:
    - https://attack.mitre.org/techniques/T1558/003/
    - https://umbrasec.dev/research/detecting-kerberoasting.html
author: UMBRASEC
date: 2026/06/10
tags:
    - attack.credential_access
    - attack.t1558.003
correlation:
    type: value_count
    rules:
        - kerberoasting_4769_base
    group-by:
        - TargetUserName
    timespan: 5m
    condition:
        gte: 15
        field: ServiceName
---
title: Kerberoasting 4769 base
id: 2d0e5c88-3f66-4012-cc4b-7e9f0a1b2c33
name: kerberoasting_4769_base
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4769
        Status: '0x0'
    filter_machine:
        TargetUserName|endswith: '$'
    condition: selection and not filter_machine