A powershell script to detect Kerberoasting attack using Windows event logs which not require any additional cost in addition to use combination event logs to reduce the false positive.