DCSync: asking the domain controller for the hashes
Domain controllers replicate credentials via the MS-DRSR protocol. Whoever has replication rights can request those hashes by impersonating a DC.
The attack
With DS-Replication-Get-Changes permissions (Domain Admins have them, but misconfigured ACLs grant them to normal users too), you extract any account's hash, including krbtgt (the golden-ticket key):
mimikatz lsadump::dcsync /user:krbtgt
impacket-secretsdump -just-dc dom/admin@dcNo code on the DC is needed: it is legitimate replication traffic, hence stealthy.
Defence
Audit who has replication rights on the domain (often granted by mistake). Monitor DRSR requests from non-DC hosts. Admin tiering. After a suspected krbtgt DCSync, rotate it twice.