Certighost
These credentials are used to perform DCSync or other activities, resulting in logon events from domain controller computer account originating from a non-domain controller IP address.
Microsoft Sentinel (KQL)

These credentials are used to perform DCSync or other activities, resulting in logon events from domain controller computer account originating from a non-domain controller IP address.

Already have an account?