The latest Mandiant M-Trends report states that it takes an average of 101 days from the time of breach to discovery. Sophisticated attacks on Kerberos authentication such as Golden Ticket type attacks against domain controllers typically take even longer to detect. Attackers go unnoticed for months on end and by the time they're finally discovered, there is very little that security teams can do. Often, these attacks start with a phishing attack. The attacker then gains access to the network and proceeds to move laterally until gaining access to critical infrastructure such as domain controllers.