Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 04:46:45 UTC

Privilege Escalation Attempt

Medium Resolved
ALR-00370 · 2026-10-07T03:35:56Z

Description

User 's.jones' on SRV-WEB-01 attempted to escalate to SYSTEM via token manipulation. DLP Module blocked the attempt.

Alert Metadata

Alert ID
ALR-00370
Timestamp
2026-10-07T03:35:56Z
Severity
Medium
Status
Resolved
Detection Source
DLP Module
Assigned Analyst
Anika Patel

Endpoint Information

Hostname
SRV-WEB-01
User Account
s.jones
Source IP
103.252.216.70
Destination IP
10.2.85.45
Origin Country
UA Ukraine

MITRE ATT&CK Mapping

Tactic
Privilege Escalation
Technique
T1134
Reference
attack.mitre.org/techniques/T1134

Investigation Timeline

03:35:56 Event ingested by SOC365 Engine
03:35:59 EmilyAI triage started — correlation enrichment
03:36:11 EmilyAI confidence: 78% — escalated to human analyst
03:36:16 Alert assigned to analyst: Anika Patel
03:37:27 Investigation started — querying SIEM and threat intelligence
03:44:33 Containment action taken — endpoint isolated
03:49:44 Alert resolved — remediation complete

Related Alerts

ID Time Alert Severity Status Host
ALR-00104 3h ago Credential Stuffing Attempt Medium False Positive SRV-WEB-01
ALR-00082 6h ago Privilege Escalation Attempt Low False Positive WS-LAP-010
ALR-00130 7h ago Privilege Escalation Attempt Informational Escalated WS-LAP-011
ALR-00018 9h ago DecoyPulse Honeypot Triggered High Open SRV-WEB-01
ALR-00020 10h ago Brute Force SSH Medium Escalated SRV-WEB-01