Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 03:43:18 UTC

Pass-the-Hash Detected

Low Escalated
ALR-00076 · 2026-10-07T23:36:22Z

Description

Pass-the-Hash technique detected on SRV-FILE-01. NTLM authentication from 'e.evans' without standard Kerberos ticket. Attack Surface Scanner flagged.

Alert Metadata

Alert ID
ALR-00076
Timestamp
2026-10-07T23:36:22Z
Severity
Low
Status
Escalated
Detection Source
Attack Surface Scanner
Assigned Analyst
EmilyAI (auto)

Endpoint Information

Hostname
SRV-FILE-01
User Account
e.evans
Source IP
185.98.220.4
Destination IP
10.0.110.202
Origin Country
DE Germany

MITRE ATT&CK Mapping

Tactic
Lateral Movement
Technique
T1550.002
Reference
attack.mitre.org/techniques/T1550.002

Investigation Timeline

23:36:22 Event ingested by SOC365 Engine
23:36:25 EmilyAI triage started — correlation enrichment
23:36:30 EmilyAI confidence: 93% — escalated to human analyst
23:36:43 Alert assigned to analyst: EmilyAI (auto)
23:37:51 Investigation started — querying SIEM and threat intelligence
23:39:24 Containment action taken — endpoint isolated
23:49:47 Alert resolved — remediation complete

Related Alerts

ID Time Alert Severity Status Host
ALR-00175 3h ago Pass-the-Hash Detected Critical Open SRV-WEB-01
ALR-00408 9h ago Pass-the-Hash Detected Low False Positive WS-PC-001
ALR-00302 13h ago Pass-the-Hash Detected Low Escalated WS-PC-001
ALR-00339 19h ago Pass-the-Hash Detected High Escalated SRV-MAIL-01
ALR-00434 1d ago Pass-the-Hash Detected Informational Open SRV-MAIL-01