Zeek kerberos.log RC4 detection

zcat kerberos.log.gz | zeek-cut cipher | grep rc4-hmac | sort | uniq -c

Analyze Zeek's kerberos.log to count Kerberos tickets issued with RC4 encryption, the signature of kerberoasting on the network.

Run it on the Zeek logs of the domain segment when you want the network view of kerberoasting: each TGS issued by the DC leaves an entry in kerberos.log with the encryption used. Filtering by rc4-hmac gives you the volume of RC4 tickets, and cross-referencing with the service accounts (service field) shows which SPNs are being requested with weak encryption. It's the detection that works even if the DC audit fails or the SIEM doesn't have the Security logs — Kerberos traffic passes through the sensor span. The rc4-hmac baseline on your network sets the threshold: in modern domains, any RC4 ticket for a service account is suspicious.

Don't use it in networks where legacy applications force RC4 regularly: the background noise of legitimate rc4-hmac tickets drowns out the signal, and you need a per-service-account baseline. Zeek only sees traffic that passes through the capture point: if the sensor doesn't see the DC segment, you'll see nothing. And note: AES kerberoasting leaves no RC4 signature — this detection covers the classic variant; the modern one needs volume correlation per account. For the attack detail (who requested), Zeek's kerberos.log gives the source IP, but the requesting user's identity is sometimes only in the DC's 4769.