Privilege Escalation Attempt
Low
Escalated
ALR-00008 · 2026-07-09T15:47:45Z
Description
User 'a.wilson' on VM-DEV-01 attempted to escalate to SYSTEM via token manipulation. EmilyAI Triage blocked the attempt.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
15:47:45
Event ingested by SOC365 Engine
15:47:48
EmilyAI triage started — correlation enrichment
15:47:57
EmilyAI confidence: 79% — escalated to human analyst
15:48:26
Alert assigned to analyst: EmilyAI (auto)
15:49:08
Investigation started — querying SIEM and threat intelligence
15:57:03
Containment action taken — endpoint isolated
15:58:25
Alert resolved — remediation complete
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00097 | 5m ago | DLP Policy Violation | Medium | Escalated | VM-DEV-01 |
| ALR-00495 | 1h ago | Pass-the-Hash Detected | Low | Resolved | VM-DEV-01 |
| ALR-00229 | 12h ago | Privilege Escalation Attempt | Low | Escalated | SRV-SQL-01 |
| ALR-00335 | 18h ago | Ransomware Behaviour Detected | Informational | False Positive | VM-DEV-01 |
| ALR-00484 | 19h ago | Privilege Escalation Attempt | High | Open | SRV-SQL-01 |