Suspicious PowerShell Execution

Low Resolved

ALR-00018 · 2026-07-06T17:02:21Z

Description

Encoded PowerShell command executed on SRV-DC-01 by user 'j.smith'. Command attempts to download and execute remote payload. Flagged by EmilyAI Triage.

Alert Metadata

Alert ID: ALR-00018
Timestamp: 2026-07-06T17:02:21Z
Severity: Low
Status: Resolved
Detection Source: EmilyAI Triage
Assigned Analyst: EmilyAI (auto)

Endpoint Information

Hostname: SRV-DC-01
User Account: j.smith
Source IP: 91.162.195.5
Destination IP: 10.0.227.236
Origin Country: IR Iran

MITRE ATT&CK Mapping

Tactic: Execution
Technique: T1059.001
Reference: attack.mitre.org/techniques/T1059.001

Investigation Timeline

17:02:21 Event ingested by SOC365 Engine

17:02:26 EmilyAI triage started — correlation enrichment

17:02:31 EmilyAI confidence: 95% — escalated to human analyst

17:02:43 Alert assigned to analyst: EmilyAI (auto)

17:04:06 Investigation started — querying SIEM and threat intelligence

17:10:16 Containment action taken — endpoint isolated

17:18:10 Alert resolved — remediation complete

Related Alerts

ID	Time	Alert	Severity	Status	Host
ALR-00169	2h ago	Suspicious PowerShell Execution	High	Investigating	WS-LAP-011
ALR-00143	4h ago	Malware Signature Match	Informational	Escalated	SRV-DC-01
ALR-00232	9h ago	Suspicious PowerShell Execution	Critical	Investigating	SRV-SQL-01
ALR-00328	12h ago	Unusual Outbound Traffic	Informational	Open	SRV-DC-01
ALR-00289	16h ago	Port Scan Detected	Informational	Resolved	SRV-DC-01