Privilege Escalation Attempt
Medium
Escalated
ALR-00326 · 2026-07-05T05:57:58Z
Description
User 'a.wilson' on SRV-BACKUP-01 attempted to escalate to SYSTEM via token manipulation. DecoyPulse blocked the attempt.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
05:57:58
Event ingested by SOC365 Engine
05:58:02
EmilyAI triage started — correlation enrichment
05:58:06
EmilyAI confidence: 89% — escalated to human analyst
05:58:14
Alert assigned to analyst: Marcus Webb
05:58:54
Investigation started — querying SIEM and threat intelligence
06:06:25
Containment action taken — endpoint isolated
06:09:27
Alert resolved — remediation complete
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00277 | 2h ago | Privilege Escalation Attempt | Low | Escalated | WS-PC-003 |
| ALR-00369 | 4h ago | Privilege Escalation Attempt | Informational | Investigating | WS-LAP-012 |
| ALR-00079 | 6h ago | Rogue DHCP Server | Low | Investigating | SRV-BACKUP-01 |
| ALR-00363 | 8h ago | Shadow IT Discovery | Medium | False Positive | SRV-BACKUP-01 |
| ALR-00313 | 10h ago | Privilege Escalation Attempt | Medium | False Positive | WS-MAC-005 |