// REFERENCE
4769 — Kerberos service ticket requested (TGS-REQ)
Log: Security
High risk
A service ticket (TGS) was requested for an SPN. It's the central event for detecting Kerberoasting: many requests from one account toward several SPNs, especially with RC4 (0x17) encryption, point to bulk ticket extraction for offline cracking.
Related tools
Work with this in:
Related
4768
4768 — Kerberos TGT requested (AS-REQ) 4770
4770 — Kerberos service ticket renewed 4771
4771 — Kerberos pre-authentication failed 4776
4776 — NTLM credential validation
4768 — Kerberos TGT requested (AS-REQ) 4770
4770 — Kerberos service ticket renewed 4771
4771 — Kerberos pre-authentication failed 4776
4776 — NTLM credential validation
Original descriptions based on Microsoft's public documentation. IDs and fields may vary with the Windows version and the active audit policy.