Data Source: Windows Event Log Security 4768

Date: 2025-07-10

ID: 4a5fd6ed-66bd-4f34-bc74-51c00c73c298

Author: Patrick Bareiss, Splunk

Description

Logs Kerberos pre-authentication requests, including details about the user account, authentication type, and client IP address.

Details

Property	Value
Source	`XmlWinEventLog:Security`
Sourcetype	`XmlWinEventLog`
Separator	EventCode

Name ▲▼	Technique ▲▼	Type ▲▼
Kerberos TGT Request Using RC4 Encryption	Use Alternate Authentication Material	TTP
Kerberos User Enumeration	Email Addresses	Anomaly
PetitPotam Suspicious Kerberos TGT Request	OS Credential Dumping	TTP
Suspicious Ticket Granting Ticket Request	Domain Accounts	Hunting
Windows Computer Account Requesting Kerberos Ticket	Steal or Forge Kerberos Tickets	TTP
Windows Multiple Disabled Users Failed To Authenticate Wth Kerberos	Password Spraying	TTP
Windows Multiple Invalid Users Fail To Authenticate Using Kerberos	Password Spraying	TTP
Windows Steal Authentication Certificates - ESC1 Authentication	Steal or Forge Authentication Certificates, Use Alternate Authentication Material	TTP
Windows Unusual Count Of Disabled Users Failed Auth Using Kerberos	Password Spraying	Anomaly
Windows Unusual Count Of Invalid Users Fail To Auth Using Kerberos	Password Spraying	Anomaly

Supported Apps

Splunk Add-on for Microsoft Windows (version 9.1.2)

Event Fields

+ Fields

  <span class="pill kill-chain">_time</span>
  
  <span class="pill kill-chain">Channel</span>
  
  <span class="pill kill-chain">Computer</span>
  
  <span class="pill kill-chain">Error_Code</span>
  
  <span class="pill kill-chain">EventCode</span>
  
  <span class="pill kill-chain">EventData_Xml</span>
  
  <span class="pill kill-chain">EventID</span>
  
  <span class="pill kill-chain">EventRecordID</span>
  
  <span class="pill kill-chain">Guid</span>
  
  <span class="pill kill-chain">IpAddress</span>
  
  <span class="pill kill-chain">IpPort</span>
  
  <span class="pill kill-chain">Keywords</span>
  
  <span class="pill kill-chain">Level</span>
  
  <span class="pill kill-chain">Name</span>
  
  <span class="pill kill-chain">Opcode</span>
  
  <span class="pill kill-chain">PreAuthType</span>
  
  <span class="pill kill-chain">ProcessID</span>
  
  <span class="pill kill-chain">RecordNumber</span>
  
  <span class="pill kill-chain">ServiceName</span>
  
  <span class="pill kill-chain">ServiceSid</span>
  
  <span class="pill kill-chain">Source_Port</span>
  
  <span class="pill kill-chain">Source_Workstation</span>
  
  <span class="pill kill-chain">Status</span>
  
  <span class="pill kill-chain">SystemTime</span>
  
  <span class="pill kill-chain">System_Props_Xml</span>
  
  <span class="pill kill-chain">TargetDomainName</span>
  
  <span class="pill kill-chain">TargetSid</span>
  
  <span class="pill kill-chain">TargetUserName</span>
  
  <span class="pill kill-chain">Target_Domain</span>
  
  <span class="pill kill-chain">Target_User_Name</span>
  
  <span class="pill kill-chain">Task</span>
  
  <span class="pill kill-chain">ThreadID</span>
  
  <span class="pill kill-chain">TicketEncryptionType</span>
  
  <span class="pill kill-chain">TicketOptions</span>
  
  <span class="pill kill-chain">Version</span>
  
  <span class="pill kill-chain">action</span>
  
  <span class="pill kill-chain">app</span>
  
  <span class="pill kill-chain">date_hour</span>
  
  <span class="pill kill-chain">date_mday</span>
  
  <span class="pill kill-chain">date_minute</span>
  
  <span class="pill kill-chain">date_month</span>
  
  <span class="pill kill-chain">date_second</span>
  
  <span class="pill kill-chain">date_wday</span>
  
  <span class="pill kill-chain">date_year</span>
  
  <span class="pill kill-chain">date_zone</span>
  
  <span class="pill kill-chain">dest</span>
  
  <span class="pill kill-chain">dest_nt_domain</span>
  
  <span class="pill kill-chain">dvc</span>
  
  <span class="pill kill-chain">dvc_nt_host</span>
  
  <span class="pill kill-chain">event_id</span>
  
  <span class="pill kill-chain">eventtype</span>
  
  <span class="pill kill-chain">host</span>
  
  <span class="pill kill-chain">id</span>
  
  <span class="pill kill-chain">index</span>
  
  <span class="pill kill-chain">linecount</span>
  
  <span class="pill kill-chain">name</span>
  
  <span class="pill kill-chain">product</span>
  
  <span class="pill kill-chain">punct</span>
  
  <span class="pill kill-chain">service</span>
  
  <span class="pill kill-chain">service_id</span>
  
  <span class="pill kill-chain">service_name</span>
  
  <span class="pill kill-chain">signature</span>
  
  <span class="pill kill-chain">signature_id</span>
  
  <span class="pill kill-chain">source</span>
  
  <span class="pill kill-chain">sourcetype</span>
  
  <span class="pill kill-chain">splunk_server</span>
  
  <span class="pill kill-chain">src</span>
  
  <span class="pill kill-chain">src_ip</span>
  
  <span class="pill kill-chain">src_nt_host</span>
  
  <span class="pill kill-chain">src_port</span>
  
  <span class="pill kill-chain">status</span>
  
  <span class="pill kill-chain">subject</span>
  
  <span class="pill kill-chain">ta_windows_action</span>
  
  <span class="pill kill-chain">ta_windows_status</span>
  
  <span class="pill kill-chain">tag</span>
  
  <span class="pill kill-chain">tag::action</span>
  
  <span class="pill kill-chain">tag::eventtype</span>
  
  <span class="pill kill-chain">timeendpos</span>
  
  <span class="pill kill-chain">timestartpos</span>
  
  <span class="pill kill-chain">user</span>
  
  <span class="pill kill-chain">user_group</span>
  
  <span class="pill kill-chain">vendor</span>
  
  <span class="pill kill-chain">vendor_product</span>
  
</div>

Example Log

1<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-A5BA-3E3B0328C30D}'/><EventID>4768</EventID><Version>0</Version><Level>0</Level><Task>14339</Task><Opcode>0</Opcode><Keywords>0x8010000000000000</Keywords><TimeCreated SystemTime='2022-09-08T18:16:25.601071000Z'/><EventRecordID>391562</EventRecordID><Correlation/><Execution ProcessID='644' ThreadID='3500'/><Channel>Security</Channel><Computer>win-dc-mvelazco-02713-392.attackrange.local</Computer><Security/></System><EventData><Data Name='TargetUserName'>RXETPKZH</Data><Data Name='TargetDomainName'>attackrange.local</Data><Data Name='TargetSid'>NULL SID</Data><Data Name='ServiceName'>krbtgt/attackrange.local</Data><Data Name='ServiceSid'>NULL SID</Data><Data Name='TicketOptions'>0x40810010</Data><Data Name='Status'>0x12</Data><Data Name='TicketEncryptionType'>0xffffffff</Data><Data Name='PreAuthType'>-</Data><Data Name='IpAddress'>::ffff:10.0.1.15</Data><Data Name='IpPort'>64568</Data><Data Name='CertIssuerName'></Data><Data Name='CertSerialNumber'></Data><Data Name='CertThumbprint'></Data></EventData></Event>

Required Output Fields

dest

Source: GitHub | Version: 3