SOC Event Lookup
Event ID 4769KerberosP1

Windows Event ID 4769: A Kerberos service ticket was requested

Applicable version
Windows Server 2008 R2 and later; Windows 7 and later
Last reviewed
2026-07-21

Quick summary

Windows Security Event ID 4769 records a Kerberos service-ticket request on a domain controller and is central to detecting anomalous service access and Kerberoasting patterns.

Technical Metadata

Technical metadata for Event ID 4769
Event ID4769
ProviderMicrosoft-Windows-Security-Auditing
ChannelSecurity
LevelInformation
Audit keywordAudit Success or Audit Failure
MITRE ATT&CKTA0006 Credential Access / T1558.003 Kerberoasting
Key fields to watchAccount Name, Service Name, Client Address, Ticket Encryption Type

Trigger Scenarios

The event is logged whenever a client requests a ticket for a service principal name. A normal user session may generate several requests as it accesses file servers, web applications, and other Kerberos-enabled services.

Key Fields

Account Name

The user or computer account requesting the service ticket. Assess whether the requester is expected to access the target service.

Service Name

The SPN for the requested service. Requests for many distinct or high-value service accounts can reveal enumeration or ticket collection.

Client Address

The client IP address observed by the domain controller. It helps identify the source device conducting unusual service-ticket activity.

Ticket Encryption Type

The encryption type used for the service ticket. RC4 requests for service accounts can be relevant when investigating Kerberoasting exposure.

Threat Hunting Queries

Microsoft Sentinel KQL: RC4 service tickets for Kerberoasting triage
SecurityEvent
| where EventID == 4769 and TicketEncryptionType == "0x17"
| summarize ServiceCount=dcount(ServiceName), Requests=count() by IpAddress, TargetAccount, bin(TimeGenerated, 1h)
| where ServiceCount > 20
Data source
Microsoft Sentinel SecurityEvent table
Assumptions
The 20-service value is an environment-specific starting threshold, not a Microsoft threshold. RC4 remains legitimate for documented legacy accounts; compare the service account's supported encryption types and available keys before escalating.
Query reference
Splunk SPL: RC4 service tickets for Kerberoasting triage
index=wineventlog source="WinEventLog:Security" EventCode=4769 TicketEncryptionType=0x17
| bin _time span=1h
| stats dc(ServiceName) as service_count count as requests by _time, IpAddress, TargetUserName
| where service_count > 20
Data source
Splunk Windows Security event data
Assumptions
Field aliases vary by Splunk add-on and must be mapped to the Windows XML names. The service-count threshold must be baselined against application, backup, and monitoring accounts.
Cortex XQL: Retrieve Kerberos service-ticket events
dataset = microsoft_windows_raw
| filter edr_event_id = 4769
Data source
Cortex XDR microsoft_windows_raw
Assumptions
Domain controller Security logs are ingested into Cortex XDR. Inspect the raw TicketEncryptionType, ServiceName, IpAddress, and post-January-2025 supported-encryption fields because parsed raw-field names can vary by collection path.
Query reference
Sigma rule: RC4 Kerberos service ticket request
title: RC4 Kerberos Service Ticket Request
status: experimental
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4769
        TicketEncryptionType: '0x17'
    condition: selection
falsepositives:
    - Documented legacy services that do not yet support AES Kerberos keys
level: medium
tags:
    - attack.credential-access
    - attack.t1558.003
Data source
Sigma Windows Security log source
Assumptions
An RC4 ticket is a candidate event, not proof of Kerberoasting; correlation and account encryption context are required.
Query reference

Documented Values and Codes

Documented event values and their security relevance
FieldValueMeaningSecurity relevance
TicketEncryptionType0x17RC4-HMAC was used for the issued service ticket.RC4 service tickets are relevant to Kerberoasting triage because their encrypted material can be targeted for offline password cracking; legacy compatibility must be excluded. Source
TicketEncryptionType0x11AES128-CTS-HMAC-SHA1-96 was used for the service ticket.Microsoft identifies AES-family 0x11 and 0x12 as expected ticket encryption values on modern Windows environments. Source
TicketEncryptionType0x12AES256-CTS-HMAC-SHA1-96 was used for the service ticket.Use it with account supported-encryption fields to distinguish modern AES operation from unexpected RC4 fallback. Source
FailureCode0x20The service ticket has expired.Microsoft describes this as a common informational failure with little or no security relevance, so it should not be treated as a high-priority Kerberos attack signal by itself. Source

MITRE ATT&CK Mapping

  • T1558.003Kerberoasting

Detection Notes

T1558.003 Kerberoasting is indicated when Ticket Encryption Type is 0x17 (RC4-HMAC) for a service SPN in an AES-only domain. RC4 service tickets are cheaper to crack offline than AES tickets. Treat broad SPN collection as a hunting pattern rather than a Microsoft threshold: tune locally, for example Client Address requesting more than 20 distinct Service Name values in one hour, then validate the requester against known application, backup, and monitoring accounts.

Common False Positives

  • Application servers and middleware may request many service tickets during normal operation.
  • Inventory, backup, and monitoring accounts often access broad sets of services.
  • Legacy service accounts can legitimately use RC4 until the environment is remediated.

Related Events

Sample Log

Sanitized event sample
Account Name: [email protected]
Service Name: MSSQLSvc/sql01.corp.example:1433
Client Address: 10.x.x.x
Ticket Encryption Type: 0x12
Failure Code: 0x0

Frequently Asked Questions

What does Windows Event ID 4769 record?

Event ID 4769 records a Kerberos Ticket Granting Service request on a domain controller, including the requesting account, target service, client address, ticket options, encryption type, and success or failure information.

Does Ticket Encryption Type 0x17 prove Kerberoasting?

No. The value means RC4-HMAC was used and is relevant to Kerberoasting exposure, but legacy applications and accounts can legitimately require RC4; validate service-account keys, supported encryption types, request volume, and client behavior.

Which encryption types are expected for modern 4769 events?

Microsoft identifies 0x11 as AES128 and 0x12 as AES256 and recommends investigating ticket encryption values outside those AES types on modern Windows environments.

Sources