Possible Privilege Escalation through Local Kerberos Relay over LDAP (via security)

This rule detects an anomalous local successful logon event where the Logon Package is Kerberos, the remote address is set to localhost, and the target user SID is the built-in local Administrator account. This may indicate an attempt to abuse a Kerberos relay attack variant that can be leveraged to elevate privilege locally from a domain joined limited user to local System privileges.