It seems the thing to do in detection now-a-days is to sweep the network looking for bad guys by collecting data off individual computers in the network.  For example, running various WMIC queries across a domain; with a domain admin account.  But as you guys know, that's apparently not a good idea with Windows storing password hashes and even clear text passwords in memory.  So how can those responsible for finding compromised boxes avoid giving attackers domain admin?

Wow, I guess I somehow missed that blog post... thanks.