Understanding and Detecting MITRE T1003.006 - OS Credential Dumping: DCSync
Techniques to Identify Active Directory Enumeration