Ransomware Behaviour Detected

Low Resolved

ALR-00073 · 2026-07-05T19:20:00Z

Description

File encryption behaviour detected on SRV-BACKUP-01. 142 files renamed with .locked extension in 30 seconds. Attack Surface Scanner isolated endpoint.

Alert Metadata

Alert ID: ALR-00073
Timestamp: 2026-07-05T19:20:00Z
Severity: Low
Status: Resolved
Detection Source: Attack Surface Scanner
Assigned Analyst: EmilyAI (auto)

Endpoint Information

Hostname: SRV-BACKUP-01
User Account: c.williams
Source IP: 185.106.220.155
Destination IP: 10.1.56.180
Origin Country: RO Romania

MITRE ATT&CK Mapping

Tactic: Impact
Technique: T1486
Reference: attack.mitre.org/techniques/T1486

Investigation Timeline

19:20:00 Event ingested by SOC365 Engine

19:20:03 EmilyAI triage started — correlation enrichment

19:20:06 EmilyAI confidence: 79% — escalated to human analyst

19:20:32 Alert assigned to analyst: EmilyAI (auto)

19:22:16 Investigation started — querying SIEM and threat intelligence

19:27:30 Containment action taken — endpoint isolated

19:32:41 Alert resolved — remediation complete

Related Alerts

ID	Time	Alert	Severity	Status	Host
ALR-00440	4h ago	Malware Signature Match	Critical	Escalated	SRV-BACKUP-01
ALR-00333	5h ago	Ransomware Behaviour Detected	Medium	Open	WS-LAP-012
ALR-00199	7h ago	C2 Beacon Activity	Low	Resolved	SRV-BACKUP-01
ALR-00085	12h ago	Ransomware Behaviour Detected	Low	Resolved	FW-EDGE-01
ALR-00386	14h ago	Ransomware Behaviour Detected	Medium	Resolved	WS-PC-001