Splunk kerberoasting search

index=windows EventCode=4769 TicketEncryptionType=0x17 | stats count by TargetUserName

Splunk search that detects kerberoasting by centralizing event 4769 with RC4 encryption from all domain controllers.

Run it in Splunk when the Security log from DCs is already centralized and you want real-time kerberoasting detection, not post-hoc. The base search filters 4769 with TicketEncryptionType 0x17 and groups by account: the result tells you which users request RC4 TGS and with what volume. In an environment with multiple DCs, this search sees the whole domain at once, something the local query on a single DC doesn't do. It's the basis for turning it into an alert with a time window: the same SPL with a 15-minute lookback and a count threshold is an operational detection rule.

Don't use it if your DCs don't send the Security log to Splunk with the parsed fields (TicketEncryptionType, TargetUserName): without proper indexing, the search returns empty even if there's kerberoasting. The TicketEncryptionType field depends on the Windows add-on and sourcetype parsing — verify with a known 4769 first. And the usual limitation: the 0x17 filter doesn't see AES kerberoasting from modern tools. For full coverage, the alert must combine this SPL with volume detection by service account (BLUE·014 as baseline).