Privilege Escalation Attempt
Low
False Positive
ALR-00228 · 2026-05-24T06:27:03Z
Description
User 'd.walker' on WS-PC-001 attempted to escalate to SYSTEM via token manipulation. Network IDS blocked the attempt.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
06:27:03
Event ingested by SOC365 Engine
06:27:08
EmilyAI triage started — correlation enrichment
06:27:13
EmilyAI confidence: 92% — escalated to human analyst
06:27:23
Alert assigned to analyst: EmilyAI (auto)
06:28:46
Investigation started — querying SIEM and threat intelligence
06:34:40
Containment action taken — endpoint isolated
06:45:44
Alert resolved — remediation complete
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00155 | 1h ago | Privilege Escalation Attempt | High | Escalated | SRV-SQL-01 |
| ALR-00225 | 5h ago | Privilege Escalation Attempt | Medium | Investigating | WS-PC-003 |
| ALR-00256 | 6h ago | Shadow IT Discovery | Low | Escalated | WS-PC-001 |
| ALR-00163 | 7h ago | Anomalous DNS Query | Medium | False Positive | WS-PC-001 |
| ALR-00474 | 7h ago | Privilege Escalation Attempt | Medium | Investigating | WS-PC-006 |