Get-WinEvent 4768 ASREPRoast

Get-WinEvent -FilterHashtable @{LogName='Security';ID=4768} | Where {$_.Properties[7].Value -eq '0x17'}

Hunts for TGT issuances (Event 4768) without preauthentication and with RC4 encryption, the signature of AS-REP Roasting attacks.

Run it on the DC when you want to hunt for AS-REP Roasting: the attacker requests a TGT for an account with the 'Do not require Kerberos preauthentication' option (DONT_REQ_PREAUTH), receives a ticket encrypted with the account's hash, and cracks it offline. The combination of PreAuthType 0 + RC4 encryption in event 4768 is the signature. Complement the vulnerable accounts query (BLUE·015): first you get the list of accounts with DONT_REQ_PREAUTH from the directory, and this query tells you if someone is exploiting it. In domains where nobody uses that option, any 4768 with PreAuthType 0 is a direct incident.

Do not use it in domains where legacy applications legitimately use accounts without preauthentication: there will be background noise and you will need a baseline. The RC4 filter (0x17) falls short just like in kerberoasting: modern tools (Rubeus asreproast) request AES when the domain supports it — for full coverage, also look at TicketEncryptionType 0x12 and prefer correlation by vulnerable account. And remember: event 4768 is generated on the DC that issues the TGT; if the domain has multiple DCs and the KDC is not the one you are querying, you will miss events.