9bfdcba400
add another detection rule for delegation via the attack described in harmj0y's blog: https://www.harmj0y.net/blog/redteaming/another-word-on-delegation/