agentsclimarketplace
Sign in

Hunting kerberoasting and ticket attacks

Skill meltedinhex/analyst-ai-pack/skills/hunting-kerberoasting-and-ticket-attacks

Hunts for Kerberoasting and related ticket attacks by analyzing Kerberos service ticket request events (4769) for weak encryption types, abnormal request volume per account, and non-machine accounts requesting many SPNs. Activates for requests to hunt Kerberoasting, detect RC4 ticket requests, or find SPN-targeting credential attacks.From its SKILL.md

Install
npx -y skills add meltedinhex/analyst-ai-pack --skill hunting-kerberoasting-and-ticket-attacks

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 21 stars21 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its file declares

Copied from the file, not written here

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

2.7 KB, 438 tokens by cl100k_base, as published. Nobody here has run it

Hunting Kerberoasting and Ticket Attacks

When to Use

  • You have Kerberos service ticket request events (Event ID 4769) and want to detect Kerberoasting (bulk TGS requests with crackable RC4 encryption against service accounts).
  • You are investigating AD credential-access activity.

Do not use this for AS-REP roasting (4768 with preauth disabled) — that is a related but separate hunt; this focuses on 4769 TGS requests.

Prerequisites

  • Event ID 4769 records with account name, service name (SPN), ticket encryption type, and client address.

Workflow

Step 1: Flag weak-encryption ticket requests

python scripts/analyst.py hunt 4769_events.csv

Flags tickets with encryption type 0x17 (RC4-HMAC) — the crackable type Kerberoasting prefers — and computes per-account SPN request volume.

Step 2: Detect bulk SPN targeting

Surface accounts requesting tickets for many distinct SPNs in a short window (a single user enumerating service accounts).

Step 3: Confirm

Correlate with the requesting host and whether the account legitimately needs those services.

Step 4: Operationalize

Write a detection for RC4 4769 requests from non-machine accounts above a volume threshold.

Validation

  • RC4 (0x17) requests are distinguished from AES (0x11/0x12).
  • Per-account distinct-SPN counts identify bulk targeting.
  • Findings map to ATT&CK T1558.003.

Pitfalls

  • Legacy applications legitimately using RC4 — baseline before alerting.
  • Failure code 0x0 (success) only; some logs include failures that skew counts.
  • Service accounts with many SPNs producing benign volume — combine with encryption-type weakness.

References

What ships with it: 3 files

4.3 KB alongside SKILL.md, 1 of them executable

references/

scripts/

Keep looking

Skills are one crate of 325,949. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.