Sigma rule: No Suitable Encryption Key Found For Generating Kerberos Ticket

Rule

Title

No Suitable Encryption Key Found For Generating Kerberos Ticket

Status

test

Level

low

Author

@SerkinValery

Date

2024-03-07

Modified

2025-09-22

File

rules/windows/builtin/system/microsoft_windows_kerberos_key_distribution_center/win_system_kdcsvc_tgs_no_suitable_encryption_key_found.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects errors when a target server doesn't have suitable keys for generating kerberos tickets.
This issue can occur for example when a service uses a user account or a computer account that is configured for only DES encryption on a computer that is running Windows 7 which has DES encryption for Kerberos authentication disabled.

Log source

product

windows

service

system

Detection

selection:
    Provider_Name:
        - 'Kerberos-Key-Distribution-Center'
        - 'Microsoft-Windows-Kerberos-Key-Distribution-Center'
    EventID:
        - 16 # KDCEVENT_NO_KEY_INTERSECTION_TGS
        - 27 # KDCEVENT_UNSUPPORTED_ETYPE_REQUEST_TGS
condition: selection

False positives (as the rule lists them)

• Unknown

Tags

• attack.credential-access
• attack.t1558.003

MITRE ATT&CK ids this rule names

• T1558.003

References

• https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd348773(v=ws.10)
• https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/kdc-event-16-27-des-encryption-disabled

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/builtin/system/microsoft_windows_kerberos_key_distribution_center/win_system_kdcsvc_tgs_no_suitable_encryption_key_found.yml