Certificate-based DC logon followed within seconds by DCSync replication
Correlates a PKINIT-based Kerberos logon to a domain controller with a subsequent DCSync attack alert for the same account within a 60-second window, leveraging Microsoft Defender for Identity and Microsoft Defender XDR.
Microsoft Sentinel (KQL)
