Activity Related to NTDS.dit Domain Hash Retrieval

Detects suspicious commands that could be related to activity that uses volume shadow copy to steal and retrieve hashes from the NTDS.dit file remotely