Suspicious PowerShell Execution

Low Escalated

ALR-00026 · 2026-07-07T18:26:46Z

Description

Encoded PowerShell command executed on SRV-DC-01 by user 'h.roberts'. Command attempts to download and execute remote payload. Flagged by Dark Web Monitor.

Alert Metadata

Alert ID: ALR-00026
Timestamp: 2026-07-07T18:26:46Z
Severity: Low
Status: Escalated
Detection Source: Dark Web Monitor
Assigned Analyst: EmilyAI (auto)

Endpoint Information

Hostname: SRV-DC-01
User Account: h.roberts
Source IP: 45.80.148.232
Destination IP: 10.1.115.52
Origin Country: UA Ukraine

MITRE ATT&CK Mapping

Tactic: Execution
Technique: T1059.001
Reference: attack.mitre.org/techniques/T1059.001

Investigation Timeline

18:26:46 Event ingested by SOC365 Engine

18:26:49 EmilyAI triage started — correlation enrichment

18:27:00 EmilyAI confidence: 97% — escalated to human analyst

18:27:07 Alert assigned to analyst: EmilyAI (auto)

18:28:23 Investigation started — querying SIEM and threat intelligence

18:33:18 Containment action taken — endpoint isolated

18:41:36 Alert resolved — remediation complete

Related Alerts

ID	Time	Alert	Severity	Status	Host
ALR-00169	2h ago	Suspicious PowerShell Execution	High	Investigating	WS-LAP-011
ALR-00143	4h ago	Malware Signature Match	Informational	Escalated	SRV-DC-01
ALR-00232	9h ago	Suspicious PowerShell Execution	Critical	Investigating	SRV-SQL-01
ALR-00328	12h ago	Unusual Outbound Traffic	Informational	Open	SRV-DC-01
ALR-00289	16h ago	Port Scan Detected	Informational	Resolved	SRV-DC-01