Suspicious modification of a fake domain controller SPN (DCshadow)

Detects scenarios where an attacker updates the Service Principal Name (SPN) of a fake domain controller account in order to perform DCshadow attack.