EVID 4768, 4771 : Kerberos Events (Part 1) (Security)

Event Details

Event Type	Audit Kerberos Authentication Service
Event Description	4768(S, F) : A Kerberos authentication ticket (TGT) was requested. 4771(F) : Kerberos pre-authentication failed.
Event ID	4768, 4771

Log Fields and Parsing

This section details the log fields available in this log message type, along with values parsed for both LogRhythm Default and LogRhythm Default v2.0 policies. A value of "N/A" (not applicable) means that there is no value parsed for a specified log field.

Log Field	LogRhythm Default	LogRhythm Default v2.0
Provider	N/A	N/A
EventID	<vmid>	<vmid>
Version	N/A	N/A
Level	<severity>	<severity>
Task	N/A	<vendorinfo>
Opcode	N/A	N/A
Keywords	<tag1>	<result>
TimeCreated	N/A	N/A
EventRecordID	N/A	N/A
Correlation	N/A	N/A
Execution	N/A	N/A
Processid	<processid>	N/A
Channel	N/A	N/A
Computer	<dname>	<dname>
EventData	<vendorinfo>, <subject>	N/A
TargetUserName	N/A	<login>
TargetDomainName	N/A	<domainorigin>
SubjectUserName	N/A	N/A
SubjectDomainName	N/A	N/A
SubjectLogonId	N/A	N/A
ReasonCode	N/A	N/A
ReasonText	N/A	N/A
ErrorCode	N/A	N/A
serviceName	<group>	<process>
TicketOptions	<policy>	N/A
status	N/A	<responsecode>, <tag2>
TicketEncryptionType	<version>	N/A
IpAddress / Client Address	<sip>	<sip>
Ip Port / Client Port	<sport>	<sport>
status	N/A	N/A
FailureCode	<objectname>, <tag3>	N/A
Pre-Authentication Type	<object>	N/A
AccountName	<login>, <tag2>	N/A
AccountDomain	<domain>	N/A
Result Code	<objectname>, <tag3>	N/A

Log Processing Settings

This section details log processing changes made from the LogRhythm Default policy to LogRhythm Default v2.0. In some cases, base rules are broken down into sub-rules to appropriately parse log message types by their event types.

LogRhythm Default

Regex ID	Rule Name	Rule Type	Common Event	Classification
1000311	EVID 4768, 4770, 4771 : Kerberos Events	Base Rule	Authentication Activity	Authentication Success
	General Kerberos Failure	Sub Rule	Authentication Failure Activity	Authentication Failure
	Credentials For Server Have Been Revoked	Sub Rule	Access Revoked Activity	Access Revoked
	TGT Has Been Revoked	Sub Rule	Access Revoked Activity	Access Revoked
	Password Has Expired	Sub Rule	User Logon Failure : Bad Password	Authentication Failure
	Bad Password	Sub Rule	User Logon Failure : Bad Password	Authentication Failure
	EVID 4769 : Serv Principal Valid User-To-User Only	Sub Rule	Domain Trust Information	Information
	Clock Skew Too Great	Sub Rule	Clock Skew Too Great	Warning
	Invalid Message Type	Sub Rule	Invalid Message Type	Error
	Message Stream Modified	Sub Rule	Message Stream Modified	Information
	Message Out Of Order	Sub Rule	Message Out Of Order	Error
	Incorrect Message Direction	Sub Rule	Incorrect Message Direction	Error
	Incorrect Sequence Number In Message	Sub Rule	Incorrect Sequence Number	Error
	Inappropriate Type Of Checksum In Message	Sub Rule	Inappropriate Type Of Checksum	Error
	Generic Error	Sub Rule	Generic Error	Error
	Field Is Too Long For This Implementation	Sub Rule	Field Is Too Long	Error
	EVID 4768 : Kerberos Auth Ticket (TGT) Requested	Sub Rule	User Logon	Authentication Success
	EVID 4768 : Auth Ticket Granted, User Acct	Sub Rule	User Logon	Authentication Success
	EVID 4769 : Svc Ticket Granted, User Acct	Sub Rule	Authentication Activity	Authentication Success
	EVID 4770 : Ticket Renewed, System Acct	Sub Rule	Authentication Activity	Authentication Success
	EVID 4770 : Ticket Renewed, System Acct	Sub Rule	Authentication Activity	Authentication Success
	EVID 4770 : Ticket Renewed, User Account	Sub Rule	Authentication Activity	Authentication Success
	EVID 4769 : Svc Ticket Granted, User Acct	Sub Rule	Authentication Activity	Authentication Success
	EVID 4770 : Ticket Renewed, System Acct	Sub Rule	Authentication Activity	Authentication Success
	EVID 4769 : Svc Ticket Granted, Sys Acct	Sub Rule	Authentication Activity	Authentication Success
	EVID 4769 : Svc Ticket Granted, Sys Acct	Sub Rule	Authentication Activity	Authentication Success
	EVID 674 : Ticket Renewed, System Acct	Sub Rule	Authentication Activity	Authentication Success
	Integrity Check On Decrypted Field Failed	Sub Rule	Integrity Check On Decrypted Field Failed	Warning
	Ticket Expired	Sub Rule	User Logon Failure	Authentication Failure
	Ticket Not Yet Valid	Sub Rule	User Logon Failure	Authentication Failure
	Request Is A Replay	Sub Rule	User Logon Failure	Authentication Failure
	The Ticket Is Not For Us	Sub Rule	User Logon Failure	Authentication Failure
	Ticket And Authenticator Do Not Match	Sub Rule	User Logon Failure	Authentication Failure
	Pre-auth Information Was Invalid	Sub Rule	User Logon Failure	Authentication Failure
	Additional Pre-authentication Required	Sub Rule	User Logon Failure	Authentication Failure
	Client Not Yet Valid	Sub Rule	User Logon Failure	Authentication Failure
	Server Not Yet Valid	Sub Rule	User Logon Failure	Authentication Failure
	Client Key Encrypted In Old Master Key	Sub Rule	User Logon Failure	Authentication Failure
	Server Key Encrypted In Old Master Key	Sub Rule	User Logon Failure	Authentication Failure
	Client Not Found In Kerberos Database	Sub Rule	User Logon Failure	Authentication Failure
	Server Not Found In Kerberos Database	Sub Rule	User Logon Failure	Authentication Failure
	Multiple Principal Entries In Database	Sub Rule	User Logon Failure	Authentication Failure
	Client Or Server Has Null Key	Sub Rule	User Logon Failure	Authentication Failure
	Client Database Entry Has Expired	Sub Rule	User Logon Failure	Authentication Failure
	Server Database Entry Has Expired	Sub Rule	User Logon Failure	Authentication Failure
	Requested Start Time Is Later Than End Time	Sub Rule	User Logon Failure	Authentication Failure
	KDC Policy Rejects Request	Sub Rule	User Logon Failure	Authentication Failure
	KDC Cannot Accommodate Request Option	Sub Rule	User Logon Failure	Authentication Failure
	KDC Has No Support For Encryption Type	Sub Rule	User Logon Failure	Authentication Failure
	KDC Has No Support For Checksum Type	Sub Rule	User Logon Failure	Authentication Failure
	KDC Has No Support For Padata Type	Sub Rule	User Logon Failure	Authentication Failure
	KDC Has No Support For Transited Type	Sub Rule	User Logon Failure	Authentication Failure
	Clients Credentials For Server Have Been Revoked	Sub Rule	User Logon Failure	Authentication Failure
	EVID 4768 : Kerberos Auth Ticket (TGT) Failure	Sub Rule	User Logon Failure	Authentication Failure
	EVID 4770 : Ticket Renew Denied, User Acct	Sub Rule	User Logon Failure	Authentication Failure
	EVID 4769 : Svc Ticket Denied, User Acct	Sub Rule	User Logon Failure	Authentication Failure
	EVID 4771 : Kerberos Pre-Authentication Failed	Sub Rule	User Logon Failure	Authentication Failure
	EVID 4769 : Svc Ticket Denied, User Acct	Sub Rule	User Logon Failure	Authentication Failure
	EVID 4768 : Clients Credentials For Server Revoked	Sub Rule	User Logon Failure	Authentication Failure
	EVID 4768 : Client Not Found In Kerberos Database	Sub Rule	User Logon Failure	Authentication Failure
	EVID 4768 : Auth Ticket Denied, User Acct	Sub Rule	User Logon Failure	Authentication Failure
	Alternative Authentication Method Required	Sub Rule	User Logon Failure	Authentication Failure
	Incorrect Net Address	Sub Rule	User Logon Failure	Authentication Failure
	Protocol Version Mismatch	Sub Rule	User Logon Failure	Authentication Failure
Specified Version Of Key Is Not Available	Sub Rule	User Logon Failure	Authentication Failure
Service Key Not Available	Sub Rule	User Logon Failure	Authentication Failure
Mutual Authentication Failed	Sub Rule	User Logon Failure	Authentication Failure
EVID 4768 : Kerberos Auth Ticket (TGT) Requested	Sub Rule	Computer Logon	Authentication Success
EVID 4768 : Kerberos Auth Ticket (TGT) Requested	Sub Rule	Computer Logon	Authentication Success
EVID 4768 : Auth Ticket Granted, Sys Acct	Sub Rule	Computer Logon	Authentication Success
EVID 4768 : Auth Ticket Granted, Sys Acct	Sub Rule	Computer Logon	Authentication Success
EVID 4771 : Kerberos Pre-Authentication Failed Sys	Sub Rule	Computer Logon Failure	Authentication Failure
EVID 4768 : Kerberos Auth Ticket (TGT) Failure	Sub Rule	Computer Logon Failure	Authentication Failure
EVID 4769 : Svc Ticket Denied, Sys Acct	Sub Rule	Computer Logon Failure	Authentication Failure
EVID 4770 : Ticket Renew Denied, Sys Acct	Sub Rule	Computer Logon Failure	Authentication Failure
EVID 4769 : Svc Ticket Denied, Sys Acct	Sub Rule	Computer Logon Failure	Authentication Failure
EVID 4768 : Auth Ticket Denied, Sys Acct	Sub Rule	Computer Logon Failure	Authentication Failure
Account Locked	Sub Rule	User Logon Failure : Account Locked Out	Authentication Failure
Ticket Not Eligible For Postdating	Sub Rule	Modify Object Attribute Failure	Access Failure
Unsupported Protocol	Sub Rule	Reconnaissance Activity	Reconnaissance

LogRhythm Default v2.0

Regex ID	Rule Name	Rule Type	Common Event	Classification
1011089	V 2.0 : EVID 4768-4771 : Kerberos TGT Failure Msg	Base Rule	General Authentication Event	Other Audit
	V 2.0 : EVID 4768 : Computer Logon Success	Sub Rule	Computer Logon	Authentication Success
	V 2.0 : EVID 4768 : User Logon Success	Sub Rule	User Logon	Authentication Success
	V 2.0 : EVID 4768 : Computer Logon Failure -Bad Us	Sub Rule	Computer Logon Failure	Authentication Failure
	V 2.0 : EVID 4768 : Computer Logon Failure - Clock	Sub Rule	Computer Logon Failure	Authentication Failure
	V 2.0 : EVID 4768 : Computer Logon Failure-Unsprt	Sub Rule	Computer Logon Failure	Authentication Failure
	V 2.0 : EVID 4768 : Computer Logon Failure Invald	Sub Rule	Computer Logon Failure	Authentication Failure
	V 2.0 : EVID 4768 : Computer Logon Flr Credential	Sub Rule	Computer Logon Failure	Authentication Failure
	V 2.0 : EVID 4768 : Computer Logon Failure Pswrd	Sub Rule	Computer Logon Failure	Authentication Failure
	V 2.0 : EVID 4768 : Computer Logon Failure Bad Pas	Sub Rule	Computer Logon Failure	Authentication Failure
	V 2.0 : EVID 4768 : Computer Logon Failure - Expir	Sub Rule	Computer Logon Failure	Authentication Failure
	V 2.0 : EVID 4768 : Computer Logon Failure - Tkt	Sub Rule	Computer Logon Failure	Authentication Failure
	V 2.0 : EVID 4768 : Computer Logon Failure-Duplkte	Sub Rule	Computer Logon Failure	Authentication Failure
	V 2.0 : EVID 4768 : Computer Logon Failure - Clock	Sub Rule	Computer Logon Failure	Authentication Failure
	V 2.0 : EVID 4768 : User Logon Failure- Bad User	Sub Rule	User Logon Failure : Bad Username	Authentication Failure
	V 2.0 : EVID 4768 : User Logon Failure - Clock Out	Sub Rule	User Logon Failure	Authentication Failure
	V 2.0 : EVID 4768 : User Logon Failure - Unsupport	Sub Rule	User Logon Failure	Authentication Failure
	V 2.0 : EVID 4768 : User Logon Failure- Invalid Ce	Sub Rule	User Logon Failure	Authentication Failure
	V 2.0 : EVID 4768 : User Logon Failure - Credentia	Sub Rule	User Logon Failure : Account Disabled	Authentication Failure
	V 2.0 : EVID 4768 : User Logon Failure- Password E	Sub Rule	User Logon Failure : Bad Password	Authentication Failure
	V 2.0 : EVID 4768 : User Logon Failure- Bad Pswrd	Sub Rule	User Logon Failure : Bad Password	Authentication Failure
	V 2.0 : EVID 4768 : User Logon Failure Expired Tkt	Sub Rule	User Logon Failure	Authentication Failure

[data-colorid=eqenf8to0j]{color:#0563c1} html[data-color-mode=dark] [data-colorid=eqenf8to0j]{color:#3e9cfa}Event Details

Log Fields and Parsing

Log Processing Settings

LogRhythm Default

LogRhythm Default v2.0

Event Details