DCSync Replication Request Targeting krbtgt Account (Golden Ticket Prep)
Detects a DCSync (directory replication) request targeting the krbtgt account, which yields the key material needed to forge Golden Tickets and impersonate any domain user. CISA's red team DCSynced krbtgt early in its Active Directory compromise (AA26-237A).
Microsoft Sentinel (KQL)
