Windows PowerView Kerberos Service Ticket Request

This analytic detects the execution of the `Get-DomainSPNTicket` commandlet, which is part of the PowerView tool, by monitoring PowerShell Script Block Logging (EventCode=4104). This commandlet is used to request Kerberos service tickets for specified Service Principal Names (SPNs). Detecting this activity is critical because it can indicate attempts to perform Kerberoasting, a technique where attackers extract SPN account passwords for offline cracking. If this activity is confirmed to be malicious, it could lead to unauthorized access to sensitive accounts, potentially resulting in privilege escalation and further compromise of the network.