🧰 PowerView

The items that name it 4

• From Code to Coverage (Part 6): What netlogon.log Sees That Event 1644 Never Will
  writeup2026-06-24

  Authenticated AD enumeration tool referenced as part of the detection series

• The ADWS Architecture That Hides PowerShell AD Enumeration
  writeup2026-04-08

  AD reconnaissance tool noted as also requesting security descriptors like the observed attacker activity

• PerfMon! What Is It Good For? | Huntress
  writeup2025-01-23It is written here as PowerView (Charlie Clark's fork, -Obfuscate function).

  Used to send obfuscated LDAP queries to a Domain Controller, observable in PerfMon; -Obfuscate function has existed since 2021

• Kerberosity Killed the Domain: An Offensive Kerberos Overview
  article2020-03-10

  Enumerate AD objects, e.g. Get-DomainUser to check msDS-AllowedToDelegateTo and useraccountcontrol properties