Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 04:42:31 UTC

Privilege Escalation Attempt

Low Investigating
ALR-00072 · 2026-10-06T17:42:54Z

Description

User 'h.roberts' on WS-LAP-010 attempted to escalate to SYSTEM via token manipulation. EmilyAI Triage blocked the attempt.

Alert Metadata

Alert ID
ALR-00072
Timestamp
2026-10-06T17:42:54Z
Severity
Low
Status
Investigating
Detection Source
EmilyAI Triage
Assigned Analyst
EmilyAI (auto)

Endpoint Information

Hostname
WS-LAP-010
User Account
h.roberts
Source IP
185.76.220.125
Destination IP
10.1.21.175
Origin Country
KP North Korea

MITRE ATT&CK Mapping

Tactic
Privilege Escalation
Technique
T1134
Reference
attack.mitre.org/techniques/T1134

Investigation Timeline

17:42:54 Event ingested by SOC365 Engine
17:42:58 EmilyAI triage started — correlation enrichment
17:42:59 EmilyAI confidence: 95% — escalated to human analyst
17:43:34 Alert assigned to analyst: EmilyAI (auto)
17:45:16 Investigation started — querying SIEM and threat intelligence

Related Alerts

ID Time Alert Severity Status Host
ALR-00192 56m ago Privilege Escalation Attempt High Open WS-LAP-012
ALR-00190 8h ago Suspicious PowerShell Execution Low Open WS-LAP-010
ALR-00029 11h ago Privilege Escalation Attempt Informational Open SRV-BACKUP-01
ALR-00021 12h ago Privilege Escalation Attempt Medium Investigating WS-PC-003
ALR-00073 15h ago Unauthorised USB Device Informational Escalated WS-LAP-010