Pass-the-Hash Detected
Low
Investigating
ALR-00091 · 2026-07-09T16:50:14Z
Description
Pass-the-Hash technique detected on SW-CORE-01. NTLM authentication from 'k.brown' without standard Kerberos ticket. Cloud Connector flagged.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
16:50:14
Event ingested by SOC365 Engine
16:50:15
EmilyAI triage started — correlation enrichment
16:50:19
EmilyAI confidence: 87% — escalated to human analyst
16:50:58
Alert assigned to analyst: EmilyAI (auto)
16:51:55
Investigation started — querying SIEM and threat intelligence
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00339 | 1h ago | Insider Threat Indicator | Informational | False Positive | SW-CORE-01 |
| ALR-00332 | 1h ago | Pass-the-Hash Detected | High | Open | WS-LAP-010 |
| ALR-00031 | 2h ago | Pass-the-Hash Detected | Informational | Investigating | SRV-DC-01 |
| ALR-00392 | 4h ago | Pass-the-Hash Detected | Low | Investigating | WS-PC-001 |
| ALR-00431 | 6h ago | Anomalous DNS Query | High | Escalated | SW-CORE-01 |