Pass-the-Hash Detected
Medium
Open
ALR-00363 · 2026-05-27T00:06:32Z
Description
Pass-the-Hash technique detected on WS-PC-004. NTLM authentication from 'f.hall' without standard Kerberos ticket. EmilyAI Triage flagged.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
00:06:32
Event ingested by SOC365 Engine
00:06:35
EmilyAI triage started — correlation enrichment
00:06:37
EmilyAI confidence: 93% — escalated to human analyst
00:07:17
Alert assigned to analyst: Marcus Webb
00:07:58
Investigation started — querying SIEM and threat intelligence
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00453 | 5h ago | Pass-the-Hash Detected | Low | False Positive | AP-WIFI-03 |
| ALR-00287 | 9h ago | Unusual Outbound Traffic | Medium | False Positive | WS-PC-004 |
| ALR-00460 | 12h ago | Pass-the-Hash Detected | Informational | Escalated | WS-PC-003 |
| ALR-00204 | 14h ago | Pass-the-Hash Detected | Informational | Escalated | FW-EDGE-01 |
| ALR-00412 | 1d ago | Credential Stuffing Attempt | Medium | Investigating | WS-PC-004 |