Event ID 4771 — Kerberos pre-authentication failed.

Provider: Microsoft-Windows-Security-Auditing
Channel: Security
Audit Policy: Account Logon → Kerberos Authentication Service
Collection Priority: Recommended (Palantir, others)
Opcode: Info

Description

Kerberos pre-authentication failed.

Message #

Kerberos pre-authentication failed.

Account Information:
	Security ID: %2
	Account Name: %1

Service Information:
	Service Name: %3

Network Information:
	Client Address: %7
	Client Port: %8

Additional Information:
	Ticket Options: %4
	Failure Code: %5
	Pre-Authentication Type: %6

Certificate Information:
	Certificate Issuer Name: %9
	Certificate Serial Number: %10
	Certificate Thumbprint: %11

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options and failure codes are defined in RFC 4120.

If the ticket was malformed or damaged during transit and could not be decrypted, then many fields in this event might not be present.

Fields #

Name	Description
`Account_Name`	[Account Information] Account Name.
`Security_ID`	[Account Information] Security ID.
`Service_Name`	[Service Information] Service Name.
`Ticket_Options`	[Additional Information] Ticket Options. Was malformed or damaged during transit and could not be decrypted, then many fields in this event might not be present. Bitmask flags `0x40000000` Forwardable `0x20000000` Forwarded `0x10000000` Proxiable `0x08000000` Proxy `0x04000000` Allow-postdate `0x02000000` Postdated `0x01000000` Renewable `0x00800000` Opt-hardware-auth `0x00400000` Canonicalize `0x00000010` Renewable-ok `0x00000008` Enc-tkt-in-skey `0x00000002` Renew `0x00000001` Validate
`Failure_Code`	[Additional Information] Failure Code. NTSTATUS reference
`PreAuthentication_Type`	[Additional Information] Pre-Authentication Type. Known values `0` PA-NONE `2` PA-ENC-TIMESTAMP `11` PA-ETYPE-INFO `14` PA-PK-AS-REQ-OLD `15` PA-PK-AS-REQ `16` PA-PK-AS-REP `17` PA-ETYPE-INFO2 `19` PA-ETYPE-INFO2 `20` PA-SVR-REFERRAL-INFO `128` PA-SUPPORTED-ENCTYPES `129` PA-PAC-OPTIONS `165` PA-SPAKE
`Client_Address`	[Network Information] Client Address.
`Client_Port`	[Network Information] Client Port.
`Certificate_Issuer_Name`	[Certificate Information] Certificate Issuer Name.
`Certificate_Serial_Number`	[Certificate Information] Certificate Serial Number.
`Certificate_Thumbprint`	[Certificate Information] Certificate Thumbprint.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Security-Auditing",
    "guid": "54849625-5478-4994-A5BA-3E3B0328C30D",
    "event_source_name": "",
    "event_id": 4771,
    "version": 0,
    "level": 0,
    "task": 14339,
    "opcode": 0,
    "keywords": 9227875636482146304,
    "time_created": "2020-07-22T20:29:36.425365Z",
    "event_record_id": 887114,
    "correlation": {},
    "execution": {
      "process_id": 568,
      "thread_id": 2356
    },
    "channel": "Security",
    "computer": "01566s-win16-ir.threebeesco.com",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "TargetUserName": "Administrator",
    "TargetSid": "S-1-5-21-308926384-506822093-3341789130-500",
    "ServiceName": "krbtgt/CONTOSO.COM",
    "TicketOptions": "0x10",
    "Status": "0x18",
    "PreAuthType": "2",
    "IpAddress": "172.16.66.1",
    "IpPort": "55967",
    "CertIssuerName": "",
    "CertSerialNumber": "",
    "CertThumbprint": ""
  }
}

Community Notes #

May indicate password spraying. Pivot on ClientAddress.

Detection Rules #

View all rules referencing this event →

Splunk # view in reference

Windows Multiple Users Failed To Authenticate Using Kerberos source: The following analytic identifies a single source endpoint failing to authenticate with 30 unique users using the Kerberos protocol. It leverages EventCode 4771 with Status 0x18, indicating wrong password attempts, and aggregates these events over a 5-minute window. This behavior is significant as it may indicate a Password Spraying attack, where an adversary attempts to gain initial access or elevate privileges in an Active Directory environment. If confirmed malicious, this activity could lead to unauthorized access, privilege escalation, and potential compromise of sensitive information.
Windows Unusual Count Of Users Failed To Auth Using Kerberos source: The following analytic identifies a source endpoint failing to authenticate multiple valid users using the Kerberos protocol, potentially indicating a Password Spraying attack. It leverages Event 4771, which is generated when the Key Distribution Center fails to issue a Kerberos Ticket Granting Ticket (TGT) due to a wrong password (failure code 0x18). This detection uses statistical analysis, specifically the 3-sigma rule, to identify unusual authentication failures. If confirmed malicious, this activity could allow an attacker to gain initial access or elevate privileges within an Active Directory environment.

References #

Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4771
Microsoft Learn Audit Policy https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-kerberos-authentication-service
Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4771
Example event sourced from https://github.com/Yamato-Security/hayabusa-sample-evtx

Event ID 4771 — Kerberos pre-authentication failed.

Description

Message #

Fields #

Example Event #

Community Notes #

Detection Rules #

Splunk # view in reference

Related Events #

References #