PowerView Unconstrained Delegation Discovery
This rule detects the use of PowerView commandlets, specifically `Get-DomainComputer` or `Get-NetComputer`, with the `-Unconstrained` parameter. This activity indicates reconnaissance efforts to identify Windows endpoints configured with Kerberos Unconstrained Delegation, which can be exploited for privilege escalation or lateral movement.
Splunk (SPL)
