Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 04:41:44 UTC

Privilege Escalation Attempt

Critical Open
ALR-00240 · 2026-10-11T16:02:08Z

Description

User 'h.roberts' on VM-DEV-01 attempted to escalate to SYSTEM via token manipulation. Attack Surface Scanner blocked the attempt.

Alert Metadata

Alert ID
ALR-00240
Timestamp
2026-10-11T16:02:08Z
Severity
Critical
Status
Open
Detection Source
Attack Surface Scanner
Assigned Analyst
James Okonkwo

Endpoint Information

Hostname
VM-DEV-01
User Account
h.roberts
Source IP
185.70.220.66
Destination IP
10.2.243.245
Origin Country
KP North Korea

MITRE ATT&CK Mapping

Tactic
Privilege Escalation
Technique
T1134
Reference
attack.mitre.org/techniques/T1134

Investigation Timeline

16:02:08 Event ingested by SOC365 Engine
16:02:09 EmilyAI triage started — correlation enrichment
16:02:21 EmilyAI confidence: 89% — escalated to human analyst
16:02:40 Alert assigned to analyst: James Okonkwo
16:04:34 Investigation started — querying SIEM and threat intelligence

Related Alerts

ID Time Alert Severity Status Host
ALR-00443 1h ago Privilege Escalation Attempt Medium Investigating SRV-BACKUP-01
ALR-00416 8h ago Privilege Escalation Attempt Low Open WS-MAC-005
ALR-00058 8h ago Unusual Outbound Traffic Low False Positive VM-DEV-01
ALR-00327 12h ago Suspicious Scheduled Task Low Resolved VM-DEV-01
ALR-00290 12h ago Credential Stuffing Attempt Medium Resolved VM-DEV-01