Credential Theft using the Pass-The-Ticket method is not generating events in Core