Rubeus unconstrained delegation abuse

Rubeus.exe monitor /interval:5 /nowrap

Monitors Kerberos traffic to capture TGT tickets from accounts authenticating to a host with unconstrained delegation.

When you have compromised a host with 'Unconstrained Delegation' enabled (e.g., a backup server). Rubeus monitor captures TGTs from accounts authenticating to the host, including potential Domain Admins.

If the host does not have unconstrained delegation (not common in modern environments). Also if EDR detects Rubeus.