value: The attacker discovered domain controllers (DCs) and submitted a replication request. This prompted the primary DC to replicate the credentials of other DCs back to the compromised domain administrator, using the Directory Replication Service (DRS) remote protocol.
name: OS Credential Dumping: Dcsync