Elastic ES|QL kerberoasting

FROM logs-windows.security-* | WHERE event.code == "4769" AND kerberos.encryption_type == "0x17"

Elastic Security ES|QL query that detects kerberoasting by filtering event 4769 with RC4 encryption in the Windows datastream.

Run it in Kibana when your DCs send Security logs to Elastic (Winlogbeat or Elastic Agent with Windows integration) and you want to hunt kerberoasting from the Elastic Security console. ES|QL is Elastic's current query language: the query filters the logs-windows.security-* datastream by event.code 4769 and kerberos.encryption_type 0x17, and with STATS you group by requester. It can be converted into an Elastic detection rule with the same logic and threshold, and Elastic already publishes equivalent rules for kerberoasting in its detection library.

Do not use it if your Windows integration does not parse the kerberos.encryption_type field (depends on Winlogbeat version and integration): without that field indexed, the query returns empty. Verify with a known event or use the alternative with the message field. And the usual limitation: 0x17 does not detect AES kerberoasting. On older Elastic versions (7.x without ES|QL), you need classic KQL syntax (event.code:4769 AND kerberos.encryption_type:0x17).