The Art of Detecting Kerberoast Attacks

This blog post details the Kerberoasting technique—where an attacker requests Service Principal Name (SPN) Kerberos tickets to crack service account passwords offline—and presents a low-noise, reliable detection approach using Windows event ID 4769. The author identifies six limiters (event_id=4769; ServiceName not 'krbtgt' and not ending with '$'; AccountName not machine$@domain; Failure Code = 0x0; Ticket Encryption Type = 0x17), shows how to implement them as ELK/SIEM filters (including wildcard NOT queries), and recommends mitigation such as managed service accounts and minimum 25-character SPN passwords.