Wazuh rule kerberoasting

Wazuh rule XML: <rule id="100476" level="10"><if_sid>601</if_sid><field name="win.system.eventID">4769</field><field name="win.eventdata.ticketEncryptionType">0x17</field><description>Kerberoasting attempt detected</description></rule>

Wazuh rule that alerts with level 10 when a Security log event 4769 arrives with RC4 encryption (kerberoasting).

Deploy this rule when you have Wazuh as your SIEM/EDR and DC agents sending the Security log: the rule matches the moment the 4769 with TicketEncryptionType 0x17 hits the manager, without waiting for an analyst to run a query. With level 10 (critical severity), the event jumps to the alert dashboard and can trigger an automated response (active response or notification). It's the way to have kerberoasting detection in environments where Wazuh is the only platform — the quintessential open-source stack for small and medium SOCs.

Don't use it without verifying that 4769 events reach the manager: without the Windows agents configured to collect the Security log (and without the Kerberos audit policy on the DC), the rule never fires. The ticketEncryptionType field depends on the parsing of Windows events in the manager (Wazuh's default decoders extract it in win.eventdata). And the usual limitation: 0x17 doesn't catch AES kerberoasting — if your domain is modern, complement with a volume rule per account or with detection of multiple SPN requests.