Detects newly observed RC4-HMAC Kerberos service ticket requests (Kerberoasting) by identifying a requester-to-service relationship not seen in the prior 7 days. Specifically, it flags Windows Kerberos event code 4769 with TicketEncryptionType 0x17 (RC4-HMAC) where TargetUserName and ServiceName form a previously unseen pair, excluding tickets for krbtgt and accounts ending with $, and excluding loopback/source-local activity. This pattern suggests an attacker requesting a service ticket for a service account to offline-crack the ticket. The rule relies on auditing Kerberos Service Ticket Operations and correlates the observed relationship against a 7-day history to surface novel interactions. It maps to MITRE ATT&CK T1558 (Steal or Forge Kerberos Tickets) with subtechnique T1558.003 (Kerberoasting) under Credential Access (TA0006). It also includes metadata that the detection currently uses Windows event data (event.code 4769) and related Active Directory context, and flags the event when the observed relation is new. Operational guidance notes that enabling Kerberos ticket auditing is required to generate the necessary events, and the rule provides a setup URL for enabling auditing. The rule includes a false positives note acknowledging legitimate first-time access to legacy services or cross-domain/trust activity, which may legitimately create new requester-to-service mappings with RC4. Overall, this is a medium-severity, credential-access-focused detection for Windows environments that helps identify Kerberoasting activity through newly observed Kerberos service tickets.