SOC Event Lookup
Event ID 4770KerberosP3

Windows Event ID 4770: A Kerberos service ticket was renewed

Windows Security Event ID 4770 records Ticket Granting Service ticket renewal on a domain controller.

Applicable version
Windows Server 2008 and later where the audit subcategory is enabled
Last reviewed
2026-07-13

Trigger Scenarios

Microsoft documents that this event is generated for every TGS renewal and only on domain controllers.

Key Fields

TargetUserName / TargetDomainName

UPN and Kerberos realm of the account requesting ticket renewal; computer accounts typically end with $.

ServiceName / ServiceSid

The service account or computer for which the renewed TGS is valid.

TicketOptions / TicketEncryptionType / IpAddress / IpPort

Microsoft documents TicketOptions values such as 0x40810010 and encryption types including 0x11 AES128, 0x12 AES256, and 0x17 RC4-HMAC; IpPort 0 indicates localhost.

Common False Positives

  • Microsoft states this event is typically informational.
  • Long-lived normal sessions renew Kerberos service tickets without user-visible activity.

Related Events

MITRE ATT&CK Mapping

  • T1550.003Use Alternate Authentication Material: Pass the Ticket

Detection Notes

4770 is usually informational, but investigate renewals where TicketEncryptionType=0x17 in an AES-only domain, TicketOptions includes forwarded/renewable patterns such as 0x60810010, or IpAddress renews a privileged account from an unexpected host. Microsoft documents 0x17 as RC4-HMAC and 0x40810010/0x60810010 TicketOptions semantics; combined with unusual 4769/4624 activity this can support T1550.003 Pass the Ticket rather than normal ticket lifetime renewal.

Microsoft Sentinel KQL
SecurityEvent
| where EventID == 4770
| project TimeGenerated, Computer, Account, IpAddress, TicketOptions, TicketEncryptionType, ServiceName
Splunk SPL
index=wineventlog EventCode=4770 | table _time, host, TargetUserName, IpAddress, TicketOptions, TicketEncryptionType, ServiceName
Sample Log
EventID: 4770
TargetUserName: admin@CORP.LOCAL
ServiceName: cifs/fileserver
TicketOptions: 0x60810010
TicketEncryptionType: 0x17
IpAddress: ::ffff:10.0.0.12
IpPort: 49964

Source

Official documentationMachine-readable JSON