Suspicious PowerShell Execution

Low Investigating

ALR-00024 · 2026-10-11T23:11:03Z

Description

Encoded PowerShell command executed on SRV-SQL-01 by user 's.jones'. Command attempts to download and execute remote payload. Flagged by SOC365 Engine.

Alert Metadata

Alert ID: ALR-00024
Timestamp: 2026-10-11T23:11:03Z
Severity: Low
Status: Investigating
Detection Source: SOC365 Engine
Assigned Analyst: EmilyAI (auto)

Endpoint Information

Hostname: SRV-SQL-01
User Account: s.jones
Source IP: 185.236.220.30
Destination IP: 10.0.3.159
Origin Country: IR Iran

MITRE ATT&CK Mapping

Tactic: Execution
Technique: T1059.001
Reference: attack.mitre.org/techniques/T1059.001

Investigation Timeline

23:11:03 Event ingested by SOC365 Engine

23:11:07 EmilyAI triage started — correlation enrichment

23:11:17 EmilyAI confidence: 82% — escalated to human analyst

23:11:33 Alert assigned to analyst: EmilyAI (auto)

23:12:56 Investigation started — querying SIEM and threat intelligence

Related Alerts

ID	Time	Alert	Severity	Status	Host
ALR-00105	4h ago	Data Exfiltration Attempt	Informational	Open	SRV-SQL-01
ALR-00019	4h ago	Suspicious PowerShell Execution	Low	Investigating	SRV-DC-01
ALR-00109	6h ago	Credential Stuffing Attempt	Low	Escalated	SRV-SQL-01
ALR-00058	6h ago	Lateral Movement Detected	Low	Investigating	SRV-SQL-01
ALR-00186	6h ago	Suspicious PowerShell Execution	Informational	False Positive	WS-PC-002