Identifies a PKINIT-based Kerberos authentication sequence that may indicate an UnPAC-the-Hash credential-recovery attempt. The rule detects a successful Kerberos AS-REQ pre-authentication (event 4768 with PreAuthType 16 and Status 0) using PKINIT, followed within five seconds by a same-domain-controller user-to-user service ticket request (event 4769) where the 4769 ServiceSid matches the PKINIT principal’s TargetSid. The 4769 ticket options must include ENC-TKT-IN-SKEY (with possible MASKS 0x40810008 or 0x40810018), indicating a potential client-to-client service ticket. The same domain controller and source address window (maxspan=5s) is required, ensuring a cross-stage linkage between the two Kerberos events. This pattern is consistent with UnPAC-the-Hash workflows used to decrypt the PAC and recover NT hashes for credential access and lateral movement. The PKINIT certificate may have been obtained via abuse paths (e.g., CertiGhost). The rule maps to MITRE ATT&CK credential-access techniques (T1558: Steal or Forge Kerberos Tickets) and is aligned with Active Directory monitoring use cases. It relies on Windows Security Event Logs (4768, 4769) and AD/PKINIT-related activity, providing a focused signal for potential credential-recovery tooling in a Windows/Identity Management environment.