Detecting DCSync

Which telemetry best detects a DCSync attack, where an attacker asks a domain controller to replicate password hashes?

EventID: 4662  An operation was performed on an object
Subject: CORP\helpdesk07   (workstation WS-114)
Properties: {1131f6aa-9c07-11d1-f79f-00c04fc2dcd2}
            {1131f6ad-9c07-11d1-f79f-00c04fc2dcd2}