SPN Added to Non-Service User Account
Detects modifications to Active Directory user accounts by monitoring Security Event ID 4738. The rule filters out service accounts (those ending with '$') and ensures the target username is populated.
Microsoft Sentinel (KQL)
