{"id":5235,"date":"2026-04-29T08:45:39","date_gmt":"2026-04-29T08:45:39","guid":{"rendered":"https:\/\/geekmungus.co.uk\/?p=5235"},"modified":"2026-04-29T08:45:39","modified_gmt":"2026-04-29T08:45:39","slug":"microsoft-windows-rc4-cipher-retirement-for-kerberos","status":"publish","type":"post","link":"https:\/\/geekmungus.co.uk\/?p=5235","title":{"rendered":"Microsoft Windows RC4 Cipher Retirement (for Kerberos)"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Assuming you have your Microsoft Windows Domain Controllers sending their event logs into Splunk, here is a query that will pull out the pertinent details you need to find anything that is still running non-compliant RC4 for ticketing.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Note that your index and Log names may vary.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>index=\"wineventlog\" LogName=\"Security\" EventCode IN (\"4768\", \"4769\", \"4770\", \"4771\") \n| rex field=_raw \"Account Information:\\s*\\r?\\n(?:.*\\r?\\n)*?\\s*MSDS-SupportedEncryptionTypes:\\s*(?&lt;acct_msds>&#91;^\\r\\n]+)\"\n| rex field=_raw \"Service Information:\\s*\\r?\\n(?:.*\\r?\\n)*?\\s*MSDS-SupportedEncryptionTypes:\\s*(?&lt;svc_msds>&#91;^\\r\\n]+)\"\n| rex field=_raw \"Domain Controller Information:\\s*\\r?\\n(?:.*\\r?\\n)*?\\s*MSDS-SupportedEncryptionTypes:\\s*(?&lt;dc_msds>&#91;^\\r\\n]+)\"\n| rex field=_raw \"(?s)Advertized Etypes:\\s*(?&lt;etype_section>.*?)(?:Additional Information:|Certificate Information:|Ticket information|$)\"\n| rex field=etype_section max_match=0 \"(?&lt;etypes>AES256-CTS-HMAC-SHA1-96|AES128-CTS-HMAC-SHA1-96|RC4-HMAC-NT-EXP|RC4-HMAC-OLD-EXP|RC4-HMAC-NT|DES-CBC-MD5|DES-CBC-CRC)\"\n| eval etypes=mvjoin(etypes, \", \")\n| rename Ticket_Encryption_Type AS TicEncType\n| rename Session_Encryption_Type AS SesEncType\n| rename Pre_Authentication_EncryptionType AS PreAEncType\n| eval ticket_type = case(\n    EventCode==4768, \"AS-REQ (TGT)\",\n    EventCode==4769, \"TGS-REQ (TGS)\",\n    EventCode==4770, \"RENEWAL\",\n    EventCode==4771, \"Failure\",\n    true(), \"Other\"\n)\n| sort - event_time\n| search SesEncType = 0x17 OR TicEncType = 0x17 OR PreAEncType = 0x17 OR acct_msds = \"RC4\" OR svc_msds = \"RC4\" OR dc_msds = \"RC4\"\n| table event_time Client_Address Account_Name Account_Domain service_name EventCode ticket_type TicEncType SesEncType PreAEncType Ticket_Options acct_msds svc_msds dc_msds etypes<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"683\" src=\"https:\/\/geekmungus.co.uk\/wp-content\/uploads\/2026\/04\/image-28-1024x683.png\" alt=\"\" class=\"wp-image-5236\" srcset=\"https:\/\/geekmungus.co.uk\/wp-content\/uploads\/2026\/04\/image-28-1024x683.png 1024w, https:\/\/geekmungus.co.uk\/wp-content\/uploads\/2026\/04\/image-28-300x200.png 300w, https:\/\/geekmungus.co.uk\/wp-content\/uploads\/2026\/04\/image-28-768x512.png 768w, https:\/\/geekmungus.co.uk\/wp-content\/uploads\/2026\/04\/image-28.png 1536w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n","protected":false},"excerpt":{"rendered":"<p>Assuming you have your Microsoft Windows Domain Controllers sending their event logs into Splunk, here is a query that will pull out the pertinent details you need to find anything that is still running non-compliant RC4 for ticketing. Note that your index and Log names may vary.<\/p>\n","protected":false},"author":4,"featured_media":5236,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[27,14],"tags":[],"class_list":["post-5235","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-active-directory","category-microsoft-windows"],"_links":{"self":[{"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/posts\/5235","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=5235"}],"version-history":[{"count":1,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/posts\/5235\/revisions"}],"predecessor-version":[{"id":5237,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/posts\/5235\/revisions\/5237"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/media\/5236"}],"wp:attachment":[{"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5235"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5235"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5235"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}