Suspicious modification of a user account SPN to enable Kerberoast attack

Detects scenarios where an attacker update the Service Principal Name (SPN) of a user account in order to enable Kerberoast attack and crack its password.