Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 03:45:47 UTC

Pass-the-Hash Detected

Low Investigating
ALR-00061 · 2026-10-07T06:23:47Z

Description

Pass-the-Hash technique detected on VM-DEV-01. NTLM authentication from 'r.davies' without standard Kerberos ticket. Endpoint Agent flagged.

Alert Metadata

Alert ID
ALR-00061
Timestamp
2026-10-07T06:23:47Z
Severity
Low
Status
Investigating
Detection Source
Endpoint Agent
Assigned Analyst
EmilyAI (auto)

Endpoint Information

Hostname
VM-DEV-01
User Account
r.davies
Source IP
194.30.62.248
Destination IP
10.3.17.254
Origin Country
NG Nigeria

MITRE ATT&CK Mapping

Tactic
Lateral Movement
Technique
T1550.002
Reference
attack.mitre.org/techniques/T1550.002

Investigation Timeline

06:23:47 Event ingested by SOC365 Engine
06:23:52 EmilyAI triage started — correlation enrichment
06:23:52 EmilyAI confidence: 79% — escalated to human analyst
06:24:09 Alert assigned to analyst: EmilyAI (auto)
06:25:01 Investigation started — querying SIEM and threat intelligence

Related Alerts

ID Time Alert Severity Status Host
ALR-00365 4h ago Pass-the-Hash Detected Medium Investigating AP-WIFI-03
ALR-00191 4h ago Data Exfiltration Attempt Low False Positive VM-DEV-01
ALR-00162 5h ago Pass-the-Hash Detected Low Investigating SRV-FILE-01
ALR-00177 6h ago Pass-the-Hash Detected High Escalated SRV-DC-01
ALR-00413 7h ago Shadow IT Discovery Medium Escalated VM-DEV-01