Pass-the-Hash Detected
Informational
False Positive
ALR-00147 · 2026-07-11T18:26:19Z
Description
Pass-the-Hash technique detected on WS-PC-001. NTLM authentication from 'system' without standard Kerberos ticket. Cloud Connector flagged.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
18:26:19
Event ingested by SOC365 Engine
18:26:21
EmilyAI triage started — correlation enrichment
18:26:29
EmilyAI confidence: 81% — escalated to human analyst
18:26:45
Alert assigned to analyst: EmilyAI (auto)
18:28:44
Investigation started — querying SIEM and threat intelligence
18:33:49
Containment action taken — endpoint isolated
18:37:36
Alert resolved — remediation complete
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00217 | 1h ago | Pass-the-Hash Detected | Medium | Open | FW-EDGE-01 |
| ALR-00157 | 4h ago | Rogue DHCP Server | Informational | Open | WS-PC-001 |
| ALR-00333 | 5h ago | Pass-the-Hash Detected | Low | Investigating | WS-LAP-010 |
| ALR-00236 | 5h ago | Pass-the-Hash Detected | Low | False Positive | WS-PC-006 |
| ALR-00305 | 8h ago | Pass-the-Hash Detected | Informational | Resolved | WS-PC-006 |