Privilege Escalation Attempt
Low
Investigating
ALR-00388 · 2026-07-06T21:34:47Z
Description
User 'c.williams' on WS-LAP-012 attempted to escalate to SYSTEM via token manipulation. Endpoint Agent blocked the attempt.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
21:34:47
Event ingested by SOC365 Engine
21:34:50
EmilyAI triage started — correlation enrichment
21:34:52
EmilyAI confidence: 94% — escalated to human analyst
21:35:10
Alert assigned to analyst: EmilyAI (auto)
21:36:03
Investigation started — querying SIEM and threat intelligence
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00222 | 15m ago | Anomalous DNS Query | Medium | Investigating | WS-LAP-012 |
| ALR-00464 | 1h ago | Certificate Anomaly | Low | Escalated | WS-LAP-012 |
| ALR-00109 | 5h ago | DLP Policy Violation | Low | False Positive | WS-LAP-012 |
| ALR-00249 | 8h ago | Privilege Escalation Attempt | Medium | Resolved | WS-PC-002 |
| ALR-00359 | 12h ago | Privilege Escalation Attempt | Medium | Investigating | WS-PC-006 |