drop security evtx csv · identify 4769 events with impossible ticket lifetimes · unusual encryption types · cross-realm tickets · detect golden and silver ticket use · runs locally
security evtx csv
drop evtx csv
or click
4769 · 4768 · 4672 · 4624 — kerberos + privilege events
drop security evtx csv (4769, 4768, 4672, 4624)