Powersploit SPN Enumeration [splunk-powershell]

`get_endpoint_data` `get_endpoint_data_powershell` ("Kerberoast.ps1" 
OR "GetUserSPNS.ps1" "KERBEROAST" 
OR "INVOKE-KERBEROAST" 
OR "Get-DomainSPNTicket" 
OR ("Get-NetUser" 
AND "-SPN") 
OR "Get-SPNTicket" 
OR "Convert-LDAPProperty" 
OR ("Get-DomainUser" 
AND "-SPN")) 
OR ( TERM(System.IdentityModel.Tokens.KerberosRequestorSecurityToken) 
OR (TERM(System.DirectoryServices.SearchResult) 
AND TERM(System.Collections.Hashtable))
OR(TERM(System.IdentityModel) 
AND TERM(System.DirectoryServices.ActiveDirectory.Forest) 
AND TERM(GetCurrentForest)) 
OR (TERM(System.IdentityModel) 
AND TERM(LoadWithPartialName) 
AND TERM(Reflection.Assembly)) 
OR (TERM(setspn.exe) 
AND TERM(System.IdentityModel.Tokens.KerberosRequestorSecurityToken)) 
OR (TERM(System.DirectoryServices.ActiveDirectory.Domain) 
AND TERM(System.DirectoryServices.ActiveDirectory.DirectoryContext) 
AND (TERM(GetDomain))) 
OR (TERM(System.DirectoryServices.DirectorySearcher) 
AND TERM(servicePrincipalName) 
OR TERM(servicePrincipalName)) 
OR (TERM(System.DirectoryServices.SecurityMasks) 
AND (TERM(Dacl) 
OR TERM(GROUP) 
OR TERM(OWNER) 
OR TERM(SACL) 
OR TERM(NONE))) 
OR (TERM(System.DirectoryServices.ReferralChasingOption) 
AND TERM(ALL)) 
OR (TERM(Security.AccessControl.RawSecurityDescriptor) 
OR (TERM(System.Security.Principal.SecurityIdentifier) 
AND (TERM(System.MarshalByRefObject)) 
AND TERM(System.Reflection.BindingFlags) 
AND TERM(GetProperty))) 
OR TERM(Diagnostics.CodeAnalysis.SuppressMessageAttribute) 
OR (TERM(adminCount=1) ) 
OR TERM(Management.Automation.PSCredential) 
OR (TERM(System.IdentityModel.Tokens.KerberosRequestorSecurityToken) 
AND TERM(System.BitConverter) 
AND TERM(ToString)) )
| rex field=_raw max_match=5 (?<known_ioc>"(?i)Kerberoast
| GetUserSPNS
| Get-DomainSPNTicket
| Get-NetUser.+-SPN
| Get-SPNTicket
| Convert-LDAPProperty
| Get-DomainUser.+-SPN")
| rex field=_raw max_match=1 (?<keywords_spn>"(?i)ServicePrincipalName")
| rex field=_raw max_match=5 (?<file>"[a-zA-Z0-9_]+.ps1")
| rex field=_raw (?<identity>"(?i)System.IdentityModel")
| rex field=_raw (?<token>"(?i)System.IdentityModel.Tokens.KerberosRequestorSecurityToken")
| rex field=_raw (?<forest>"(?i)System.DirectoryServices.ActiveDirectory.Forest.+")
| rex field=_raw (?<setspn>"(?i)setspn.exe")
| rex field=_raw (?<ad>"(?i)System.DirectoryServices.ActiveDirectory")
| rex field=_raw (?<convert>"(?i)System.BitConverter.+ToString")
| rex field=_raw (?<credential>"(?i)Management.Automation.PSCredential")
| rex field=_raw (?<privilege>"(?i)adminCount=1")
| rex field=_raw (?<error>"(?i)Diagnostics.CodeAnalysis.SuppressMessageAttribute.+")
| rex field=_raw (?<security1>"(?i)Security.AccessControl.RawSecurityDescriptor")
| rex field=_raw (?<security2>"(?i)System.Security.Principal.SecurityIdentifier")
| rex field=_raw (?<properties>"(?i)System.Reflection.BindingFlags.+GetProperty")
| rename ScriptBlock_ID as scriptblock_id
| eval user=mvfilter(NOT match(user, "(?i)convert
| _")), kerberoast_request=mvappend(keywords_spn, identity, token, forest, setspn, ad, convert, credential, privilege, error, security1, security2, properties)
| table _time, host, user_time, file, host, scriptblock_id, signature_id, event_id, kerberoast_request, known_ioc, error
| bin span=120s
| stats values(*) as * by _time, host