Lion Cipher Lab
Detect AS-REP roasting from Kerberos Event 4768 (and find the accounts that invite it)
- SOC Analyst / Blue Team
- Intermediate
- ~75 min
- Free · no account required
Why it matters
Kerberos protects a password with a step called pre-authentication: before the domain controller hands out a ticket-granting ticket, the user has to prove they know the password. Some accounts get that step switched off, usually years ago, for one old Linux appliance or vendor product that could not cope with it. For those accounts, anyone on the network can ask the domain controller for a reply encrypted with the account's password-derived key, carry it home, and guess passwords against it offline at full speed, with no lockout and no further noise. That is AS-REP roasting, MITRE ATT&CK…
What you'll learn
- Reading Security Event 4768 field by field: TargetUserName, IpAddress, PreAuthType, TicketEncryptionType, Status
- Decoding PreAuthType (0 / 2 / 15 / '-') and ticket encryption types (0x12 AES256, 0x17 RC4-HMAC) from Microsoft's tables
- Scoring AS-REP roasting rules (MITRE T1558.004) with precision and recall against a labeled dataset
- Building an (account, source) baseline for accounts that legitimately skip pre-authentication
- Finding every DONT_REQ_PREAUTH account by decoding userAccountControl bit 0x400000, and the LDAP bitwise filter that does it in AD
- Expressing the tuned detection as a portable Sigma rule
Steps in this lab
- What AS-REP roasting is, in plain words
- The event that carries the signal: 4768, read field by field
- Build the synthetic 4768 fixture
- Why the obvious rules disappoint (the judgement)
- Write four rules and score them
- Read the results like an analyst, not a scoreboard
- Make it portable: the tuned rule as Sigma, and the real-DC query
- The real fix: find every account that invites the attack
- Honest limits of the tuned rule
- Where this goes next