Pass-the-Hash Detected
High
Investigating
ALR-00207 · 2026-07-07T20:06:05Z
Description
Pass-the-Hash technique detected on WS-LAP-010. NTLM authentication from 'p.thomas' without standard Kerberos ticket. Cloud Connector flagged.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
20:06:05
Event ingested by SOC365 Engine
20:06:06
EmilyAI triage started — correlation enrichment
20:06:20
EmilyAI confidence: 83% — escalated to human analyst
20:06:21
Alert assigned to analyst: James Okonkwo
20:08:34
Investigation started — querying SIEM and threat intelligence
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00131 | 6h ago | Unusual Outbound Traffic | Medium | False Positive | WS-LAP-010 |
| ALR-00003 | 7h ago | Pass-the-Hash Detected | Informational | False Positive | AP-WIFI-03 |
| ALR-00248 | 7h ago | Pass-the-Hash Detected | Informational | False Positive | SRV-APP-01 |
| ALR-00292 | 11h ago | C2 Beacon Activity | Informational | Resolved | WS-LAP-010 |
| ALR-00483 | 15h ago | Failed MFA Challenge | Informational | False Positive | WS-LAP-010 |