Suspicious modification of a fake domain controller SPN (DCshadow) (Directory Services)

Detects scenarios where an attacker update the Service Principal Name (SPN) of a computer account in order to perform "Kerberos redirection" and escalate privileges.