Attack path analysis & microsegmentation
Phishing → Domain Admin
Attacker phishes low-privilege user, escalates through Kerberoasting to Domain Admin via vulnerable service account.