Suspicious PowerShell Execution
Low
Escalated
ALR-00026 · 2026-07-07T18:26:46Z
Description
Encoded PowerShell command executed on SRV-DC-01 by user 'h.roberts'. Command attempts to download and execute remote payload. Flagged by Dark Web Monitor.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
18:26:46
Event ingested by SOC365 Engine
18:26:49
EmilyAI triage started — correlation enrichment
18:27:00
EmilyAI confidence: 97% — escalated to human analyst
18:27:07
Alert assigned to analyst: EmilyAI (auto)
18:28:23
Investigation started — querying SIEM and threat intelligence
18:33:18
Containment action taken — endpoint isolated
18:41:36
Alert resolved — remediation complete
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00169 | 2h ago | Suspicious PowerShell Execution | High | Investigating | WS-LAP-011 |
| ALR-00143 | 4h ago | Malware Signature Match | Informational | Escalated | SRV-DC-01 |
| ALR-00232 | 9h ago | Suspicious PowerShell Execution | Critical | Investigating | SRV-SQL-01 |
| ALR-00328 | 12h ago | Unusual Outbound Traffic | Informational | Open | SRV-DC-01 |
| ALR-00289 | 16h ago | Port Scan Detected | Informational | Resolved | SRV-DC-01 |