Suspicious SPN enumeration previous to Kerberoasting attack (native commands)

Detects scenarios where an attacker attempts to retrieve SPN using commandline and native tools.