Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 04:00:16 UTC

Kerberoasting Attempt

High Open
ALR-00247 · 2026-10-05T13:54:50Z

Description

Kerberoasting attack detected: user 'c.williams' requested TGS tickets for multiple service accounts in 2 minutes. Flagged by Network IDS.

Alert Metadata

Alert ID
ALR-00247
Timestamp
2026-10-05T13:54:50Z
Severity
High
Status
Open
Detection Source
Network IDS
Assigned Analyst
Marcus Webb

Endpoint Information

Hostname
WS-LAP-012
User Account
c.williams
Source IP
45.4.148.113
Destination IP
10.3.56.22
Origin Country
BR Brazil

MITRE ATT&CK Mapping

Tactic
Credential Access
Technique
T1558.003
Reference
attack.mitre.org/techniques/T1558.003

Investigation Timeline

13:54:50 Event ingested by SOC365 Engine
13:54:51 EmilyAI triage started — correlation enrichment
13:55:03 EmilyAI confidence: 79% — escalated to human analyst
13:55:35 Alert assigned to analyst: Marcus Webb
13:57:14 Investigation started — querying SIEM and threat intelligence

Related Alerts

ID Time Alert Severity Status Host
ALR-00160 5h ago Kerberoasting Attempt Medium Resolved WS-PC-006
ALR-00201 9h ago Kerberoasting Attempt Low Investigating SRV-SQL-01
ALR-00464 17h ago Kerberoasting Attempt Medium Open SRV-BACKUP-01
ALR-00313 17h ago Kerberoasting Attempt Low Open SRV-APP-01
ALR-00277 18h ago Credential Stuffing Attempt Medium False Positive WS-LAP-012