Get-WinEvent 4769 kerberoasting

Get-WinEvent -FilterHashtable @{LogName='Security';ID=4769} | Where {$_.Properties[6].Value -eq '0x17'}

Searches the Security log for TGS grants (Event 4769) with RC4 encryption, the signature of classic kerberoasting.

Run it on the DC when you suspect kerberoasting: the attacker requests service tickets (TGS) for accounts with SPNs and extracts them in a crackable format. The request with RC4 encryption (0x17) is the historical signature — classic tools (Rubeus, impacket GetUserSPNs) request RC4 even if the domain supports AES. Filter by the encryption type column and group by service account: a spike of RC4 requests for an svc_* account is the finding. Works on any DC with Kerberos auditing enabled, without installing anything.

Don't use it as your only detection: since 2022, Rubeus and GetUserSPNs request AES by default when the domain supports it, and AES kerberoasting won't be caught by this filter. In domains with RC4 fully disabled (Windows Server 2019+ with strict policy), the 0x17 filter will only see noise or nothing. And watch out for false positives: legacy applications using RC4 for their TGS trigger the same event. For full coverage, complement with Event 4769 for service accounts that don't normally request tickets (behavioral baseline) and with volume correlation per account.