A successful phishing campaign compromised a service account with broad LDAP read access. Within five minutes, our SIEM correlated impossible-travel logins with unusual Kerberos ticket requests — a custom rule we built after a previous red-team exercise.
We isolated the account, forced a domain-wide password reset for the affected OU, and blocked outbound C2 destinations at the firewall. Forensics confirmed lateral movement attempts were stopped before privilege escalation.
Detection-to-containment took under five minutes. The incident reinforced that service accounts need the same monitoring rigor as human users — and that tabletop exercises pay off.