How to Determine Whether a Kerb Rost Is Malicious

The only way to request a kerb ro service ticket that i'm aware of is you have to make a ticket granny service request. Most people default to the client side because they literally don't have the capability Technically to do that correlation and so they have it's like well If I only get the server side the server side is not going to give me enough information. But at least I'm getting something I could work with when the real answer is start with the server side And then correlate that with the client side so that you have all the context you need things like that.