Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 03:50:05 UTC

Pass-the-Hash Detected

Low Open
ALR-00427 · 2026-10-09T19:24:39Z

Description

Pass-the-Hash technique detected on WS-LAP-010. NTLM authentication from 's.jones' without standard Kerberos ticket. SOC365 Engine flagged.

Alert Metadata

Alert ID
ALR-00427
Timestamp
2026-10-09T19:24:39Z
Severity
Low
Status
Open
Detection Source
SOC365 Engine
Assigned Analyst
EmilyAI (auto)

Endpoint Information

Hostname
WS-LAP-010
User Account
s.jones
Source IP
194.219.62.153
Destination IP
10.2.12.75
Origin Country
CN China

MITRE ATT&CK Mapping

Tactic
Lateral Movement
Technique
T1550.002
Reference
attack.mitre.org/techniques/T1550.002

Investigation Timeline

19:24:39 Event ingested by SOC365 Engine
19:24:41 EmilyAI triage started — correlation enrichment
19:24:47 EmilyAI confidence: 97% — escalated to human analyst
19:25:07 Alert assigned to analyst: EmilyAI (auto)
19:27:07 Investigation started — querying SIEM and threat intelligence

Related Alerts

ID Time Alert Severity Status Host
ALR-00145 1h ago Pass-the-Hash Detected Medium Resolved WS-LAP-012
ALR-00432 12h ago Credential Stuffing Attempt Low False Positive WS-LAP-010
ALR-00297 14h ago Suspicious PowerShell Execution Low False Positive WS-LAP-010
ALR-00103 14h ago Pass-the-Hash Detected Low Escalated SRV-APP-01
ALR-00499 14h ago Suspicious PowerShell Execution Low Resolved WS-LAP-010