This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(144, 22%, 23%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3E1%3C/text%3E%3C/svg%3E)
I am trying to generate Event ID 4649 (A replay attack was detected) for testing purpose. I've tried to use different tools to generate but failed to do so. Can anyone guide me or give me a documentation to generate it?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(35.2, 9%, 13%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EWL%3C/text%3E%3C/svg%3E)
Hello
A replay attack is usually related to Kerberos authentication.
4649(S) A replay attack was detected. - Windows 10 | Microsoft Learn
We may try the following link:
How to Perform Kerberoasting Attacks: The Ultimate Guide (stationx.net)
Any specific document or guide only for Replay attack, because the attacks in the above links dosen't seem contain 4649 or Replay attack