DCSync: directory replication abuse → domain creds

An unprivileged phishing foothold turns into domain-wide credential theft without cracking a single password. The actor dumps LSASS in memory, then abuses Active Directory replication, asking a domain controller to hand over its credential material as if the request came from another controller, before moving laterally and deploying a generic encryptor. Work the Windows Security log and the endpoint process tree to reconstruct the DCSync.