Replication privileges accessed to perform DCSync attack

Detects scenarios where an attacker use DCSync or SecretDump tool to exfiltrate Active Directory credentials