DCSync Directory Replication Abuse Correlated with Golden Ticket Activity
Detects potential credential dumping activity via DCSync, identified by a non-DC computer account performing directory replication (DRS GetNCChanges), correlated with subsequent suspicious Kerberos ticket requests (Event ID 4769) that utilize weak encryption (RC4 or legacy DES), which is often associated with Golden Ticket abuse.
Microsoft Sentinel (KQL)
