Privilege Escalation Attempt
Low
Open
ALR-00286 · 2026-05-21T20:13:08Z
Description
User 'r.davies' on FW-EDGE-01 attempted to escalate to SYSTEM via token manipulation. Attack Surface Scanner blocked the attempt.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
20:13:08
Event ingested by SOC365 Engine
20:13:12
EmilyAI triage started — correlation enrichment
20:13:19
EmilyAI confidence: 85% — escalated to human analyst
20:13:35
Alert assigned to analyst: EmilyAI (auto)
20:14:53
Investigation started — querying SIEM and threat intelligence
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00455 | 59m ago | Privilege Escalation Attempt | Low | Resolved | VM-DEV-01 |
| ALR-00239 | 1h ago | Lateral Movement Detected | High | Investigating | FW-EDGE-01 |
| ALR-00486 | 4h ago | C2 Beacon Activity | Medium | Open | FW-EDGE-01 |
| ALR-00091 | 8h ago | Credential Stuffing Attempt | Informational | False Positive | FW-EDGE-01 |
| ALR-00049 | 10h ago | C2 Beacon Activity | Low | Escalated | FW-EDGE-01 |