Suspicious Kerberos Ticket Request via PowerShell Script - ScriptBlock (a861d835-af37-4930-bcd6-5b178bfb54df)
Detects PowerShell scripts that utilize native PowerShell Identity modules to request Kerberos tickets. This behavior is typically seen during a Kerberos or silver ticket attack. A successful execution will output the SPNs for the endpoint in question.