Privilege Escalation Attempt
Low
Open
ALR-00499 · 2026-07-06T00:03:58Z
Description
User 'r.davies' on SRV-DC-01 attempted to escalate to SYSTEM via token manipulation. Dark Web Monitor blocked the attempt.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
00:03:58
Event ingested by SOC365 Engine
00:04:02
EmilyAI triage started — correlation enrichment
00:04:11
EmilyAI confidence: 89% — escalated to human analyst
00:04:38
Alert assigned to analyst: EmilyAI (auto)
00:04:53
Investigation started — querying SIEM and threat intelligence
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00053 | 1h ago | Lateral Movement Detected | Informational | False Positive | SRV-DC-01 |
| ALR-00277 | 2h ago | Privilege Escalation Attempt | Low | Escalated | WS-PC-003 |
| ALR-00369 | 4h ago | Privilege Escalation Attempt | Informational | Investigating | WS-LAP-012 |
| ALR-00313 | 10h ago | Privilege Escalation Attempt | Medium | False Positive | WS-MAC-005 |
| ALR-00167 | 16h ago | Privilege Escalation Attempt | Medium | Escalated | FW-EDGE-01 |