I did a presention on Kerberos attack and how by learning what is normal in the Kerberos protocol allows for defenders to write scripts detection abnormal behavior
Golden Ticket Detection Important Event IDs: 4624: Account Logon 4672: Admin Logon 4678: TGT Request 4769: TGS Request
Kerberoasting Detection Important Event IDs: 4624: Account Logon 4672: Admin Logon 4678: TGT Request 4769: TGS Request