Suspicious PowerShell Execution

Informational Resolved

ALR-00022 · 2026-10-05T12:54:43Z

Description

Encoded PowerShell command executed on SRV-APP-01 by user 'c.williams'. Command attempts to download and execute remote payload. Flagged by Cloud Connector.

Alert Metadata

Alert ID: ALR-00022
Timestamp: 2026-10-05T12:54:43Z
Severity: Informational
Status: Resolved
Detection Source: Cloud Connector
Assigned Analyst: EmilyAI (auto)

Endpoint Information

Hostname: SRV-APP-01
User Account: c.williams
Source IP: 194.141.62.230
Destination IP: 10.1.208.197
Origin Country: BR Brazil

MITRE ATT&CK Mapping

Tactic: Execution
Technique: T1059.001
Reference: attack.mitre.org/techniques/T1059.001

Investigation Timeline

12:54:43 Event ingested by SOC365 Engine

12:54:45 EmilyAI triage started — correlation enrichment

12:54:58 EmilyAI confidence: 91% — escalated to human analyst

12:55:05 Alert assigned to analyst: EmilyAI (auto)

12:55:30 Investigation started — querying SIEM and threat intelligence

13:03:47 Containment action taken — endpoint isolated

13:08:16 Alert resolved — remediation complete

Related Alerts

ID	Time	Alert	Severity	Status	Host
ALR-00159	3h ago	Rogue DHCP Server	Low	Escalated	SRV-APP-01
ALR-00019	4h ago	Suspicious PowerShell Execution	Low	Investigating	SRV-DC-01
ALR-00024	4h ago	Suspicious PowerShell Execution	Low	Investigating	SRV-SQL-01
ALR-00023	4h ago	DLP Policy Violation	Informational	Resolved	SRV-APP-01
ALR-00186	6h ago	Suspicious PowerShell Execution	Informational	False Positive	WS-PC-002