Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 04:42:31 UTC

Privilege Escalation Attempt

Low False Positive
ALR-00270 · 2026-10-09T20:04:51Z

Description

User 'h.roberts' on WS-PC-003 attempted to escalate to SYSTEM via token manipulation. Endpoint Agent blocked the attempt.

Alert Metadata

Alert ID
ALR-00270
Timestamp
2026-10-09T20:04:51Z
Severity
Low
Status
False Positive
Detection Source
Endpoint Agent
Assigned Analyst
EmilyAI (auto)

Endpoint Information

Hostname
WS-PC-003
User Account
h.roberts
Source IP
194.169.62.150
Destination IP
10.1.35.227
Origin Country
RO Romania

MITRE ATT&CK Mapping

Tactic
Privilege Escalation
Technique
T1134
Reference
attack.mitre.org/techniques/T1134

Investigation Timeline

20:04:51 Event ingested by SOC365 Engine
20:04:55 EmilyAI triage started — correlation enrichment
20:05:06 EmilyAI confidence: 81% — escalated to human analyst
20:05:06 Alert assigned to analyst: EmilyAI (auto)
20:06:00 Investigation started — querying SIEM and threat intelligence
20:09:53 Containment action taken — endpoint isolated
20:19:53 Alert resolved — remediation complete

Related Alerts

ID Time Alert Severity Status Host
ALR-00192 56m ago Privilege Escalation Attempt High Open WS-LAP-012
ALR-00029 11h ago Privilege Escalation Attempt Informational Open SRV-BACKUP-01
ALR-00021 12h ago Privilege Escalation Attempt Medium Investigating WS-PC-003
ALR-00232 15h ago Kerberoasting Attempt Medium Escalated WS-PC-003
ALR-00274 16h ago DLP Policy Violation Medium Escalated WS-PC-003