Suspicious SPN Logon from Workstation
This rule detects suspicious service account (SPN enabled) logon attempts originating from workstation subnets. This activity can be an indicator of credential dumping techniques. The rule looks for Event ID 4768 (A Kerberos authentication ticket (TGT) was requested) where the target user name is a known SPN-enabled account and the source IP address falls within defined workstation subnets.
Microsoft Sentinel (KQL)
