Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 03:45:25 UTC

Privilege Escalation Attempt

Informational Investigating
ALR-00011 · 2026-10-08T09:13:42Z

Description

User 'system' on WS-PC-004 attempted to escalate to SYSTEM via token manipulation. Dark Web Monitor blocked the attempt.

Alert Metadata

Alert ID
ALR-00011
Timestamp
2026-10-08T09:13:42Z
Severity
Informational
Status
Investigating
Detection Source
Dark Web Monitor
Assigned Analyst
EmilyAI (auto)

Endpoint Information

Hostname
WS-PC-004
User Account
system
Source IP
91.244.195.16
Destination IP
10.2.50.38
Origin Country
IR Iran

MITRE ATT&CK Mapping

Tactic
Privilege Escalation
Technique
T1134
Reference
attack.mitre.org/techniques/T1134

Investigation Timeline

09:13:42 Event ingested by SOC365 Engine
09:13:47 EmilyAI triage started — correlation enrichment
09:13:52 EmilyAI confidence: 87% — escalated to human analyst
09:14:07 Alert assigned to analyst: EmilyAI (auto)
09:15:21 Investigation started — querying SIEM and threat intelligence

Related Alerts

ID Time Alert Severity Status Host
ALR-00143 1h ago Privilege Escalation Attempt Informational Open WS-PC-006
ALR-00182 2h ago Failed MFA Challenge Medium Resolved WS-PC-004
ALR-00138 3h ago Unauthorised USB Device Low Open WS-PC-004
ALR-00460 3h ago Privilege Escalation Attempt Medium Open WS-LAP-012
ALR-00248 12h ago Privilege Escalation Attempt Low Resolved SRV-BACKUP-01