KQL Sentinel kerberoasting

SecurityEvent | where EventID == 4769 and TicketEncryptionType == "0x17"

KQL query for Microsoft Sentinel that detects kerberoasting on event 4769 with RC4 encryption from all connected hosts.

Run it in Sentinel when your domain sends Security logs to Log Analytics (via agent or Windows Security Events connector) and you want to hunt for kerberoasting without touching the DCs. The base query filters 4769 with RC4; extended with summarize and the AccountName field gives you the volume per requester. In hybrid Azure environments it's the natural path: events are already in the workspace, the query is reproducible, and it becomes a scheduled alert with one click. It's also the basis for the analytic rules Microsoft suggests for Kerberos.

Don't use it if Security logs don't reach Log Analytics: without the Windows Security Events connector or the AMA agent deployed, the SecurityEvent table is empty. Watch out for performance: filtering SecurityEvent without a time index (wide time range) is expensive — always limit the window. And the limitation shared with all 0x17 detections: modern AES kerberoasting you won't see. For that, complement with the 4769 table grouping by service account and baseline deviation.