DCSYNC attack or crackmapexec --ntds

InsightIDR Event Sources
,
1

Hello friends. does anyone know a way for me to monitor AD when someone runs DCSYNC attack with secretdumps or crackmapexec ?

i think a made it.

wmi with unparsed data

1131f6aa-9c07-11d1-f79f-00c04fc2dcd2 and 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2