Function is_dcsync 

pub fn is_dcsync(primitives: &[ControlPrimitive]) -> bool

True if the set of primitives held over the domain head amounts to DCSync.

Get-Changes alone is not enough; it needs Get-Changes-All (or a blanket right).