Privilege Escalation Attempt
Medium
Resolved
ALR-00095 · 2026-05-23T18:44:33Z
Description
User 'e.evans' on SRV-WEB-01 attempted to escalate to SYSTEM via token manipulation. Attack Surface Scanner blocked the attempt.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
18:44:33
Event ingested by SOC365 Engine
18:44:35
EmilyAI triage started — correlation enrichment
18:44:38
EmilyAI confidence: 79% — escalated to human analyst
18:45:18
Alert assigned to analyst: Sarah Chen
18:47:28
Investigation started — querying SIEM and threat intelligence
18:50:12
Containment action taken — endpoint isolated
18:56:52
Alert resolved — remediation complete
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00128 | 2h ago | Privilege Escalation Attempt | Low | Open | SRV-FILE-01 |
| ALR-00474 | 6h ago | Privilege Escalation Attempt | Low | Open | SRV-SQL-01 |
| ALR-00011 | 7h ago | Data Exfiltration Attempt | High | Escalated | SRV-WEB-01 |
| ALR-00283 | 8h ago | Privilege Escalation Attempt | Medium | Investigating | AP-WIFI-03 |
| ALR-00406 | 10h ago | Data Exfiltration Attempt | Informational | False Positive | SRV-WEB-01 |