Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 03:57:37 UTC

Privilege Escalation Attempt

Medium False Positive
ALR-00228 · 2026-10-10T07:35:12Z

Description

User 's.jones' on WS-LAP-011 attempted to escalate to SYSTEM via token manipulation. Network IDS blocked the attempt.

Alert Metadata

Alert ID
ALR-00228
Timestamp
2026-10-10T07:35:12Z
Severity
Medium
Status
False Positive
Detection Source
Network IDS
Assigned Analyst
Anika Patel

Endpoint Information

Hostname
WS-LAP-011
User Account
s.jones
Source IP
194.40.62.204
Destination IP
10.2.127.133
Origin Country
DE Germany

MITRE ATT&CK Mapping

Tactic
Privilege Escalation
Technique
T1134
Reference
attack.mitre.org/techniques/T1134

Investigation Timeline

07:35:12 Event ingested by SOC365 Engine
07:35:17 EmilyAI triage started — correlation enrichment
07:35:25 EmilyAI confidence: 93% — escalated to human analyst
07:35:44 Alert assigned to analyst: Anika Patel
07:37:06 Investigation started — querying SIEM and threat intelligence
07:42:24 Containment action taken — endpoint isolated
07:49:25 Alert resolved — remediation complete

Related Alerts

ID Time Alert Severity Status Host
ALR-00251 2h ago Privilege Escalation Attempt Critical Investigating SRV-BACKUP-01
ALR-00306 5h ago Privilege Escalation Attempt Low False Positive AP-WIFI-03
ALR-00011 11h ago Privilege Escalation Attempt Informational Investigating WS-LAP-011
ALR-00266 23h ago DecoyPulse Honeypot Triggered Medium Escalated WS-LAP-011
ALR-00465 1d ago Data Exfiltration Attempt Informational Escalated WS-LAP-011