Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 04:51:33 UTC

Privilege Escalation Attempt

Informational Escalated
ALR-00395 · 2026-10-11T08:57:07Z

Description

User 'm.taylor' on SRV-DC-01 attempted to escalate to SYSTEM via token manipulation. Attack Surface Scanner blocked the attempt.

Alert Metadata

Alert ID
ALR-00395
Timestamp
2026-10-11T08:57:07Z
Severity
Informational
Status
Escalated
Detection Source
Attack Surface Scanner
Assigned Analyst
EmilyAI (auto)

Endpoint Information

Hostname
SRV-DC-01
User Account
m.taylor
Source IP
45.254.148.46
Destination IP
10.1.111.121
Origin Country
RU Russia

MITRE ATT&CK Mapping

Tactic
Privilege Escalation
Technique
T1134
Reference
attack.mitre.org/techniques/T1134

Investigation Timeline

08:57:07 Event ingested by SOC365 Engine
08:57:12 EmilyAI triage started — correlation enrichment
08:57:22 EmilyAI confidence: 87% — escalated to human analyst
08:57:50 Alert assigned to analyst: EmilyAI (auto)
08:58:21 Investigation started — querying SIEM and threat intelligence
09:02:22 Containment action taken — endpoint isolated
09:09:07 Alert resolved — remediation complete

Related Alerts

ID Time Alert Severity Status Host
ALR-00399 1h ago Privilege Escalation Attempt Informational Open SRV-WEB-01
ALR-00310 1h ago DLP Policy Violation Informational False Positive SRV-DC-01
ALR-00169 4h ago Unusual Outbound Traffic Medium Escalated SRV-DC-01
ALR-00166 6h ago Privilege Escalation Attempt High Investigating AP-WIFI-03
ALR-00123 22h ago Privilege Escalation Attempt Informational Escalated WS-LAP-012