In this Very Easy Sherlock, players will go through artefacts and logs from the Domain controller as well as endpoint artefacts from where Kerberoast attack activity was sourced. Players will work through what to look for to identify kerberoasting attack activity and to avoid false positives due to the complexity of Active Directory.
An attacker on a domain workstation loaded PowerView from a user’s Downloads folder to enumerate Active Directory objects and find accounts with service principal names. About two minutes later they ran Rubeus from the same folder to request a Kerberos service ticket for a SQL service account, asking for RC4 so the ticket would be cheap to crack offline. The domain controller logged that request as a single RC4 service ticket event among otherwise normal AES traffic, and the client address in it points straight back to the workstation. Prefetch on the endpoint lands one second before the DC event, which ties the tool run to the ticket request.
.evtx files → parse with EvtxECmd to CSV, then filter.evtx files, script block logging (event 4104) → same EvtxECmd pass.pf files → PECmdTimestamp note: Every answer is UTC in
YYYY-MM-DD hh:mm:ss, and all three timestamp questions are for the same day. Timestamps from the DC and the workstation line up to the second, so they can be compared directly.
Kerberoasting is a Kerberos service ticket request, event 4769, so parse the DC logs to CSV and start there. A domain generates 4769s constantly, so the useful filter is the ticket encryption type. Roasting tools ask for RC4 (0x17) because it is the easiest to crack, and in this domain only one 4769 uses it. That event’s timestamp is the answer.
EvtxECmd -d dc_logs --csv work/evtxgrep ',4769,' work/evtx/*.csv | grep '0x17'Tip: Filtering on RC4 is what separates the roast from the normal AES ticket noise. Without it you are scrolling through hundreds of benign 4769s.
Same event as Q1. The ServiceName field of the RC4 4769 holds the account whose ticket was requested, a SQL service account.
grep ',4769,' work/evtx/*.csv | grep '0x17'The same 4769 carries the client address that made the request. That is the workstation to triage, and the endpoint evidence in the rest of the case comes from it.
grep ',4769,' work/evtx/*.csv | grep '0x17'From Q3 the workstation is known, so move to its PowerShell operational log. Script block logging (event 4104) records the script content and path. One block comes from Downloads\powerview.ps1, the standard tool for enumerating AD objects, including accounts with SPNs that can be roasted.
EvtxECmd -d workstation_ps_logs --csv work/evtxgrep ',4104,' work/evtx/*.csv | grep -i powerviewTake the earliest 4104 script block from the PowerView path in Q4 and read its TimeCreated. The PowerShell process itself started a few seconds before that, so process start is the wrong clock for “when was the script executed”.
grep ',4104,' work/evtx/*.csv | grep -i powerview | sort | headGotcha: The process start time (a few seconds earlier) is close enough to look right but is not when the script ran. Use the first PowerView script block.
Prefetch is the execution record here. Parse the folder with PECmd; it has an entry for RUBEUS.EXE, and the files it loaded list the full path, which sits in the same Downloads folder as PowerView.
PECmd -d prefetch --csv work/pfRead the last run time on the RUBEUS.EXE prefetch entry from Q6. It is one second before the RC4 4769 on the DC from Q1, so the tool run and the ticket request are the same event seen from both ends.
PECmd -d prefetch --csv work/pf| Phase | Action |
|---|---|
| Discovery | PowerView run from the user’s Downloads folder to enumerate AD objects and SPN accounts |
| Credential Access | Rubeus run from the same folder to request a service ticket |
| Credential Access | RC4 service ticket for the SQL service account issued by the DC to the workstation |
| Type | Value |
|---|---|
| IP (source workstation) | 172.17.79[.]129 |
| Targeted service account | MSSQLService |
| File | C:\Users\alonzo.spire\Downloads\powerview.ps1 |
| File | C:\Users\alonzo.spire\Downloads\Rubeus.exe |
| Technique | ID | Description |
|---|---|---|
| Account Discovery: Domain Account | T1087.002 | PowerView used to enumerate AD objects |
| Command and Scripting Interpreter: PowerShell | T1059.001 | powerview.ps1 run in PowerShell |
| Steal or Forge Kerberos Tickets: Kerberoasting | T1558.003 | Rubeus request for an RC4 service ticket for the SQL service account |
Alert on 4769 events with RC4 (0x17) encryption. In a domain that has moved to AES these are rare and stand out. Pair the alert with the requesting account and client address, which here led straight to the workstation.
Turn on PowerShell script block logging. Event 4104 is what exposed PowerView and gave a trustworthy execution time. Without it the only trace would be a PowerShell process start.
Move service accounts to AES and use long random passwords or gMSAs. A cracked Kerberoast ticket is only useful if the service account password is guessable, and RC4 is what makes the offline attack cheap.
Watch for offensive tooling in user Downloads folders. Prefetch for Rubeus.exe and a powerview.ps1 script block, both under a user profile, are a clear signal on their own.
Correlate DC and endpoint timestamps. A one-second gap between the Rubeus run and the ticket request confirmed the source host without any guesswork.
The attacker enumerated and roasted a SQL service account in about two minutes using two publicly available tools run from a Downloads folder. One RC4 ticket request on the domain controller was enough to find the host, and endpoint logging confirmed the rest.