DCSync
Pretending to be a domain controller and asking the real ones to replicate the password database. No code runs on the server; it is a perfectly legitimate feature used wrongly.
Domain controllers stay in sync through the MS-DRSR protocol, whose DRSGetNCChanges call fetches changes for a naming context — password hashes included. The required rights, DS-Replication-Get-Changes and its All counterpart, normally belong only to Domain Admins, Enterprise Admins and the domain controllers themselves, but they get handed to service accounts carelessly or linger after a migration. With them an attacker can pull the hash for any account, krbtgt included, and forge a Golden Ticket. Mimikatz does it with lsadump::dcsync. Detection is reasonable but requires actually looking: replication traffic from something that is not a domain controller is never normal.