Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 04:42:07 UTC

Pass-the-Hash Detected

Low Resolved
ALR-00123 · 2026-10-08T16:15:36Z

Description

Pass-the-Hash technique detected on SW-CORE-01. NTLM authentication from 'system' without standard Kerberos ticket. Dark Web Monitor flagged.

Alert Metadata

Alert ID
ALR-00123
Timestamp
2026-10-08T16:15:36Z
Severity
Low
Status
Resolved
Detection Source
Dark Web Monitor
Assigned Analyst
EmilyAI (auto)

Endpoint Information

Hostname
SW-CORE-01
User Account
system
Source IP
194.138.62.233
Destination IP
10.1.118.41
Origin Country
BR Brazil

MITRE ATT&CK Mapping

Tactic
Lateral Movement
Technique
T1550.002
Reference
attack.mitre.org/techniques/T1550.002

Investigation Timeline

16:15:36 Event ingested by SOC365 Engine
16:15:41 EmilyAI triage started — correlation enrichment
16:15:42 EmilyAI confidence: 80% — escalated to human analyst
16:16:15 Alert assigned to analyst: EmilyAI (auto)
16:16:56 Investigation started — querying SIEM and threat intelligence
16:23:03 Containment action taken — endpoint isolated
16:29:23 Alert resolved — remediation complete

Related Alerts

ID Time Alert Severity Status Host
ALR-00049 5h ago Phishing Email Blocked Medium Open SW-CORE-01
ALR-00451 8h ago Insider Threat Indicator High Open SW-CORE-01
ALR-00227 14h ago Certificate Anomaly Informational Open SW-CORE-01
ALR-00251 22h ago Credential Stuffing Attempt Low Investigating SW-CORE-01
ALR-00250 23h ago Pass-the-Hash Detected Low False Positive SRV-APP-01