Privilege Escalation Attempt
Medium
Resolved
ALR-00027 · 2026-07-07T13:41:22Z
Description
User 'h.roberts' on WS-PC-006 attempted to escalate to SYSTEM via token manipulation. Cloud Connector blocked the attempt.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
13:41:22
Event ingested by SOC365 Engine
13:41:25
EmilyAI triage started — correlation enrichment
13:41:28
EmilyAI confidence: 97% — escalated to human analyst
13:41:44
Alert assigned to analyst: James Okonkwo
13:43:22
Investigation started — querying SIEM and threat intelligence
13:49:08
Containment action taken — endpoint isolated
13:59:44
Alert resolved — remediation complete
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00095 | 4h ago | Tor Exit Node Connection | Medium | False Positive | WS-PC-006 |
| ALR-00187 | 6h ago | DLP Policy Violation | Medium | Escalated | WS-PC-006 |
| ALR-00237 | 7h ago | Privilege Escalation Attempt | Medium | Escalated | SRV-SQL-01 |
| ALR-00352 | 9h ago | Privilege Escalation Attempt | Informational | False Positive | WS-LAP-012 |
| ALR-00007 | 11h ago | Kerberoasting Attempt | High | Escalated | WS-PC-006 |