SOC Event Lookup
Event ID 4770KerberosP3

Windows Event ID 4770: A Kerberos service ticket was renewed

Applicable version
Windows Server 2008 and later where the audit subcategory is enabled
Last reviewed
2026-07-22

Quick summary

Windows Security Event ID 4770 records Ticket Granting Service ticket renewal on a domain controller.

Technical Metadata

Technical metadata for Event ID 4770
Event ID4770
ProviderMicrosoft-Windows-Security-Auditing
ChannelSecurity
LevelInformation
Audit keywordAudit Success
MITRE ATT&CKTA0008 Lateral Movement / T1550.003 Use Alternate Authentication Material: Pass the Ticket
Key fields to watchTargetUserName / TargetDomainName, ServiceName / ServiceSid, TicketOptions / TicketEncryptionType / IpAddress / IpPort

Trigger Scenarios

Microsoft documents that this event is generated for every TGS renewal and only on domain controllers.

Key Fields

TargetUserName / TargetDomainName

UPN and Kerberos realm of the account requesting ticket renewal; computer accounts typically end with $.

ServiceName / ServiceSid

The service account or computer for which the renewed TGS is valid.

TicketOptions / TicketEncryptionType / IpAddress / IpPort

Microsoft documents TicketOptions values such as 0x40810010 and encryption types including 0x11 AES128, 0x12 AES256, and 0x17 RC4-HMAC; IpPort 0 indicates localhost.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Windows Security Event ID 4770
SecurityEvent
| where EventID == 4770
| project TimeGenerated, Computer, EventID, RenderedDescription
| order by TimeGenerated desc
Data source
Microsoft Sentinel SecurityEvent table
Assumptions
The Windows Security Events connector populates SecurityEvent. Map raw XML fields to the event-specific fields described on this page.
Query reference
Splunk SPL: Retrieve Windows Security Event ID 4770
index=wineventlog source="WinEventLog:Security" EventCode=4770
| table _time, host, EventCode, Message
Data source
Splunk Windows Security event data
Assumptions
Index, source, and parsed field names vary by deployment. Apply the documented field conditions after validating local field extraction.
Cortex XQL: Retrieve Windows Security Event ID 4770
dataset = microsoft_windows_raw
| filter edr_event_id = 4770
Data source
Cortex XDR microsoft_windows_raw
Assumptions
The Windows Security channel is ingested into Cortex XDR. Inspect raw provider fields because parsed names vary by collection path.
Query reference
Sigma rule: Windows Security Event ID 4770
title: Windows Security Event ID 4770
status: experimental
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4770
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Security log source
Assumptions
This rule retrieves the event and is not a standalone malicious-behavior detection. Add the event-specific conditions and correlations documented on this page.
Query reference

Documented Values and Codes

Documented event values and their security relevance
FieldValueMeaningSecurity relevance
TicketEncryptionType0x17RC4-HMAC according to the Microsoft event reference.Interpret TicketEncryptionType with the other documented fields and correlated events; this value alone is not proof of compromise. Source
TicketOptions0x40810010A documented ticket-options example that must be decoded as a bit field.Interpret TicketOptions with the other documented fields and correlated events; this value alone is not proof of compromise. Source

MITRE ATT&CK Mapping

  • T1550.003Use Alternate Authentication Material: Pass the Ticket

Detection Notes

4770 is usually informational, but investigate renewals where TicketEncryptionType=0x17 in an AES-only domain, TicketOptions includes forwarded/renewable patterns such as 0x60810010, or IpAddress renews a privileged account from an unexpected host. Microsoft documents 0x17 as RC4-HMAC and 0x40810010/0x60810010 TicketOptions semantics; combined with unusual 4769/4624 activity this can support T1550.003 Pass the Ticket rather than normal ticket lifetime renewal.

Common False Positives

  • Microsoft states this event is typically informational.
  • Long-lived normal sessions renew Kerberos service tickets without user-visible activity.

Related Events

Sample Log

Sanitized event sample
EventID: 4770
TargetUserName: [email protected]
ServiceName: cifs/fileserver
TicketOptions: 0x60810010
TicketEncryptionType: 0x17
IpAddress: ::ffff:10.0.0.12
IpPort: 49964

Frequently Asked Questions

What does Windows Event ID 4770 mean?

A Kerberos service ticket was renewed on a domain controller.

Does Event ID 4770 always indicate malicious activity?

No. Renewal is normal Kerberos behavior for renewable tickets.

How should Event ID 4770 be investigated?

Review account, service, encryption type, ticket options, source address, and nearby 4769 and logon activity.

Sources