The night a domain controller replicated every password (Event 4662)

DCSync abuses legitimate replication. Event 4662 with replication GUIDs requested by a non-DC account gives it away.