Abuse of the Active Directory replication protocol (DRSUAPI): an account holding DS-Replication-Get-Changes (usually Domain Admins) impersonates a domain controller and requests secret replication — pulling the NTLM hashes of any account, including krbtgt (→ Golden Ticket).
secretsdump.py DOMAIN/svc_admin:pass@dc01 -just-dc
No code runs on the DC itself. Defense: restrict replication rights, monitor DRSUAPI from unusual hosts.