Pass-the-Hash Detected
Low
Escalated
ALR-00242 · 2026-07-11T07:09:09Z
Description
Pass-the-Hash technique detected on FW-EDGE-01. NTLM authentication from 'c.williams' without standard Kerberos ticket. Dark Web Monitor flagged.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
07:09:09
Event ingested by SOC365 Engine
07:09:13
EmilyAI triage started — correlation enrichment
07:09:19
EmilyAI confidence: 86% — escalated to human analyst
07:09:49
Alert assigned to analyst: EmilyAI (auto)
07:11:16
Investigation started — querying SIEM and threat intelligence
07:13:01
Containment action taken — endpoint isolated
07:19:38
Alert resolved — remediation complete
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00434 | 7h ago | C2 Beacon Activity | Low | Investigating | FW-EDGE-01 |
| ALR-00472 | 8h ago | Pass-the-Hash Detected | Low | Resolved | SRV-WEB-01 |
| ALR-00327 | 9h ago | Lateral Movement Detected | Low | Escalated | FW-EDGE-01 |
| ALR-00131 | 10h ago | Tor Exit Node Connection | High | Escalated | FW-EDGE-01 |
| ALR-00307 | 11h ago | Kerberoasting Attempt | Low | Investigating | FW-EDGE-01 |