Enable Auditing of Changes to msDS-KeyCredentialLink 

This post describes how to configure Active Directory auditing for the msDS-KeyCredentialLink attribute (schema GUID 5b47d60f-6090-40b2-9f37-2a4de88f3063) to detect modifications used in privilege escalation, provides PowerShell commands (including Set-AuditRule.ps1) to apply the audit rule across a domain, and supplies a Microsoft Sentinel KQL query to hunt for EventID 5136 changes to that attribute.