ScriptBlockText:asreproast\ * OR ScriptBlockText:dump\ \/service\:krbtgt\ * OR ScriptBlockText:dump\ \/luid\:0x* OR ScriptBlockText:kerberoast\ * OR ScriptBlockText:createnetonly\ \/program\:* OR ScriptBlockText:ptt\ \/ticket\:* OR ScriptBlockText:\/impersonateuser\:* OR ScriptBlockText:renew\ \/ticket\:* OR ScriptBlockText:asktgt\ \/user\:* OR ScriptBlockText:harvest\ \/interval\:* OR ScriptBlockText:s4u\ \/user\:* OR ScriptBlockText:s4u\ \/ticket\:* OR ScriptBlockText:hash\ \/password\:* OR ScriptBlockText:golden\ \/aes256\:* OR ScriptBlockText:silver\ \/user\:*