Enrich your advanced hunting experience using network layer signals from Zeek

I'm looking at some data now...
DeviceNetworkEvents|where AdditionalFields.SignatureName == "Kerberos_TGS_REQ"
I'm trying to make sense of the AdditionalFields.SignatureMatchedContent and AdditionalFields.SamplePacketContent fields in the data, but not having much luck. My expectation would be that it would URL-decode to the binary payload portion of the TGS-REQ, but I'm not seeing anything in there that makes any sense. The realm, for instance, should appear in cleartext, but it's nowhere to be seen... Also, the SignatureMatchedContent, which is "%05%A2%03%02%01%0C", doesn't appear anywhere in the SamplePacketContent at all... It almost looks compressed or encrypted somehow, but encryption makes no sense, and if it was compressed, I'd expect that to be documented? What I'm actually looking for is the TicketEncryptionType value, which will tell me what hosts are communicating using RC4.

Thanks

John