Event ID 4770: A Kerberos service ticket was renewed
Written on domain controllers when a service ticket is renewed.
- Log
- Security
- Category
- Kerberos
Why it matters
- Unusually long-lived renewals can be a sign of forged or stolen tickets being kept alive.
What to check
Check the account, service and client address against normal renewal patterns.
How to turn it on
Advanced Audit Policy on domain controllers: Account Logon > Audit Kerberos Service Ticket Operations.
Ticket encryption types
| Code | Encryption | Note |
|---|---|---|
| 0x11 | AES128-CTS-HMAC-SHA1-96 | Modern default. |
| 0x12 | AES256-CTS-HMAC-SHA1-96 | Modern default. |
| 0x17 | RC4-HMAC | Legacy. Unexpected RC4 service tickets are a common Kerberoasting sign. |
| 0x18 | RC4-HMAC-EXP | Legacy. |
| 0x1 | DES-CBC-CRC | Obsolete; disabled by default since Windows 7 / Server 2008 R2. |
| 0x3 | DES-CBC-MD5 | Obsolete; disabled by default since Windows 7 / Server 2008 R2. |
| 0xFFFFFFFF | Failure | Shown on failed requests. |
MITRE ATT&CK
- T1550.003 Pass the Ticket