DCSync Detection

Detecting the DCSync attack, in which an adversary with sufficient privilege abuses Active Directory replication to request password hashes from a domain controller as if it were one, a powerful credential-theft technique against AD.