Suspicious Kerberos Authentication Ticket Request

sequence by source.port, source.ip with maxspan=3s
 [network where host.os.type == "windows" and destination.port == 88 and
  process.executable != null and process.pid != 4 and 
  not process.executable : (
        "?:\\Windows\\system32\\lsass.exe",
        "\\device\\harddiskvolume*\\windows\\system32\\lsass.exe",
        "\\device\\harddiskvolume*\\windows\\system32\\svchost.exe"
  ) and
  not (
    process.executable : (
      "C:\\Windows\\System32\\svchost.exe",
      "C:\\Program Files\\VMware\\VMware View\\Server\\bin\\ws_TomcatService.exe",
      "C:\\Program Files\\Omnissa\\Horizon\\Server\\bin\\ws_TomcatService.exe",
      "C:\\Program Files\\SysAidServer\\root\\WEB-INF\\domains\\NetworkDiscovery.exe",
      "C:\\Program Files (x86)\\IGEL\\RemoteManager\\*\\bin\\tomcat10.exe",
      "F:\\IGEL\\RemoteManager\\*\\bin\\tomcat10.exe"
    ) and
    user.id in ("S-1-5-20", "S-1-5-18")
  ) and
  source.ip != "127.0.0.1" and destination.ip != "::1" and destination.ip != "127.0.0.1"]
 [authentication where host.os.type == "windows" and event.code in ("4768", "4769")]