The issuer is the interceptor's CA (here the mitmproxy sub-CA under CKTECK), and the path runs up to the company root instead of the public CA the site really uses; a university or bank site certified by your employer's CA makes no sense.

Comparing the certificate shown in the browser with what you would expect is the most direct way to spot interception:

• Issuer: the CA that signed the leaf. A real public website is certified by a public CA (Let's Encrypt, DigiCert, Sectigo, …). Under interception, it is the proxy's CA.
• Certification path: fake leaf ilias.hslu.ch, then mitmproxy sub-CA, then CKTECK CA, then the CKTECK root.
• Does it make sense? No. The HSLU has no relationship with CKTECK, so a CKTECK CA vouching for an HSLU site means somebody re-signed the traffic.

Visiting other sites gives the same picture: mitmproxy generates a fresh certificate per site, all from the same issuer. The browser trusts them all because it trusts that issuer.

Caveat: in many companies this is legitimate, declared TLS inspection on the firewall. The check tells you that traffic is inspected; whether that is acceptable is a policy question.

Go deeper:

• Wikipedia: Chain of trust — reading a certification path from leaf to root.
• Qualys SSL Labs: SSL Server Test — shows a site's real certificate chain from outside your network, for comparison.

PowerShell turns repetitive clicking into reusable scripts, and it passes .NET objects through its pipeline instead of text, so you can filter and process results by property.

In a Unix shell, ls | grep passes lines of text and the next command has to parse them. In PowerShell, Get-ADGroupMember -Identity Administrators returns objects with properties (name, objectClass, …), so the next command can filter on a field directly:

Get-ADGroupMember -Identity Administrators | Where-Object -Property objectClass -eq user

Typical AD tasks each become one line: New-ADUser, New-ADGroup -GroupScope Global -GroupCategory Security, Add-ADGroupMember, Move-ADObject (move to another OU), Disable-ADAccount / Enable-ADAccount, Search-ADAccount -AccountDisabled, and Get-ADGroupMember GG_CH_IT | Export-Csv users.csv for a report.

The Active Directory module ships with Windows Server; on a client it comes with the Remote Server Administration Tools (RSAT), the same package that provides the graphical AD consoles for remote administration.

Go deeper:

• Microsoft Learn: What is PowerShell? — the object pipeline and the scripting language.
• Microsoft Learn: ActiveDirectory module reference — every AD cmdlet with examples.
• Microsoft Learn: Remote Server Administration Tools — installing RSAT on a client.