(EventID:4769 Status:0x0 TicketEncryptionType:0x17) (-((ServiceName:krbtgt OR ServiceName:$) OR TargetUserName:$@*))