Roasting

Detect Active Directory LDAP queries that search for Kerberoasting (SPNs) or accounts with Kerberos preauthentication not required from Azure ATP, and try to get the process initiated the LDAP query from MDATP. Replace 389 on line 5 with LDAP port in your environment Replace true on line 6 to false if you want to include Nt Authority process This LDAP query cover Rubeus, Kerberoast, BloodHound tools