PKINIT Certificate Logon to DC Followed by DCSync Replication

ills3c Intel&Coffee@Ills3C

•updated 2 days ago•3•0•7

Correlates a certificate-based (PKINIT) Kerberos logon by an account with a DCSync-style directory replication from the same account within a 5-minute window, using Microsoft Defender for Identity logs.