KQL_win_alert_ad_user_backdoors.txt

SecurityEvent | where ((((EventID == "4738" and not (isnull(AllowedToDelegateTo))) or (EventID == "5136" and AttributeLDAPDisplayName == "msDS-AllowedToDelegateTo")) or (EventID == "5136" and ObjectClass == "user" and AttributeLDAPDisplayName == "servicePrincipalName")) or (EventID == "5136" and AttributeLDAPDisplayName == "msDS-AllowedToActOnBehalfOfOtherIdentity"))