No Suitable Encryption Key Found For Generating Kerberos Ticket

Title: No Suitable Encryption Key Found For Generating Kerberos Ticket
Status: test
Description:Detects errors when a target server doesn't have suitable keys for generating kerberos tickets. This issue can occur for example when a service uses a user account or a computer account that is configured for only DES encryption on a computer that is running Windows 7 which has DES encryption for Kerberos authentication disabled.
References:
  -https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd348773(v=ws.10)
  -https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/kdc-event-16-27-des-encryption-disabled
Author: @SerkinValery
Date: 2024-03-07
modified:2025-09-22
Tags:

• -'attack.credential-access'
• -'attack.t1558.003'

Logsource:

• product: windows
• service: system

Detection:
  selection:
    Provider_Name:
      -'Kerberos-Key-Distribution-Center'
      -'Microsoft-Windows-Kerberos-Key-Distribution-Center'

    EventID:
      -'16'
      -'27'

  condition:selection
Falsepositives:
  -Unknown
Level: low