Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 02:45:06 UTC

Suspicious Scheduled Task

Medium Investigating
ALR-00004 · 2026-10-06T19:23:08Z

Description

New scheduled task created on SRV-BACKUP-01 by 'e.evans' running encoded batch script at 02:00 daily. No change request on file.

Alert Metadata

Alert ID
ALR-00004
Timestamp
2026-10-06T19:23:08Z
Severity
Medium
Status
Investigating
Detection Source
DecoyPulse
Assigned Analyst
Emma Richardson

Endpoint Information

Hostname
SRV-BACKUP-01
User Account
e.evans
Source IP
194.245.62.170
Destination IP
10.1.32.131
Origin Country
UA Ukraine

MITRE ATT&CK Mapping

Tactic
Persistence
Technique
T1053.005
Reference
attack.mitre.org/techniques/T1053.005

Investigation Timeline

19:23:08 Event ingested by SOC365 Engine
19:23:12 EmilyAI triage started — correlation enrichment
19:23:17 EmilyAI confidence: 98% — escalated to human analyst
19:23:42 Alert assigned to analyst: Emma Richardson
19:24:56 Investigation started — querying SIEM and threat intelligence

Related Alerts

ID Time Alert Severity Status Host
ALR-00070 5h ago Suspicious Scheduled Task Medium False Positive FW-EDGE-01
ALR-00217 9h ago Shadow IT Discovery Medium False Positive SRV-BACKUP-01
ALR-00093 10h ago Suspicious Scheduled Task Medium False Positive WS-PC-006
ALR-00399 11h ago Brute Force SSH High Open SRV-BACKUP-01
ALR-00112 17h ago Suspicious Scheduled Task Medium Investigating WS-PC-002