Suspicious Scheduled Task
Low
Resolved
ALR-00031 · 2026-07-06T17:05:23Z
Description
New scheduled task created on WS-LAP-012 by 'd.walker' running encoded batch script at 02:00 daily. No change request on file.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
17:05:23
Event ingested by SOC365 Engine
17:05:26
EmilyAI triage started — correlation enrichment
17:05:29
EmilyAI confidence: 82% — escalated to human analyst
17:05:58
Alert assigned to analyst: EmilyAI (auto)
17:06:23
Investigation started — querying SIEM and threat intelligence
17:14:19
Containment action taken — endpoint isolated
17:23:00
Alert resolved — remediation complete
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00352 | 9h ago | Privilege Escalation Attempt | Informational | False Positive | WS-LAP-012 |
| ALR-00433 | 10h ago | Failed MFA Challenge | Low | Resolved | WS-LAP-012 |
| ALR-00483 | 18h ago | Brute Force SSH | Low | False Positive | WS-LAP-012 |
| ALR-00078 | 18h ago | Kerberoasting Attempt | Low | Resolved | WS-LAP-012 |
| ALR-00243 | 20h ago | Suspicious Scheduled Task | High | Open | AP-WIFI-03 |