drop security evtx csv · identify 4768 events for accounts with pre-authentication disabled · as-rep roasting attack indicators · bulk requests · unusual requestor ips · runs locally
security evtx csv
drop evtx csv
or click
4768 · 4771 — preauthtype column required
drop security evtx csv (4768, 4771)