Invoke-Kerberoast uses Get-DomainUser to query for user accounts with non-null service principle names (SPNs) Uses Get-SPNTicket to request/extract the crackable ticket information. The ticket format can be specified with -Output Format
Source: https://powersploit.readthedocs.io/en/latest/Recon/Invoke-Kerberoast/

