Suspicious PowerShell Execution

Low False Positive

ALR-00117 · 2026-07-10T12:49:22Z

Description

Encoded PowerShell command executed on WS-LAP-011 by user 'e.evans'. Command attempts to download and execute remote payload. Flagged by Endpoint Agent.

Alert Metadata

Alert ID: ALR-00117
Timestamp: 2026-07-10T12:49:22Z
Severity: Low
Status: False Positive
Detection Source: Endpoint Agent
Assigned Analyst: EmilyAI (auto)

Endpoint Information

Hostname: WS-LAP-011
User Account: e.evans
Source IP: 45.81.148.64
Destination IP: 10.1.208.171
Origin Country: GB United Kingdom

MITRE ATT&CK Mapping

Tactic: Execution
Technique: T1059.001
Reference: attack.mitre.org/techniques/T1059.001

Investigation Timeline

12:49:22 Event ingested by SOC365 Engine

12:49:23 EmilyAI triage started — correlation enrichment

12:49:30 EmilyAI confidence: 86% — escalated to human analyst

12:50:02 Alert assigned to analyst: EmilyAI (auto)

12:51:59 Investigation started — querying SIEM and threat intelligence

12:57:33 Containment action taken — endpoint isolated

13:03:43 Alert resolved — remediation complete

Related Alerts

ID	Time	Alert	Severity	Status	Host
ALR-00262	36m ago	C2 Beacon Activity	Low	False Positive	WS-LAP-011
ALR-00062	4h ago	Anomalous DNS Query	Informational	Resolved	WS-LAP-011
ALR-00107	12h ago	Suspicious Scheduled Task	Low	Resolved	WS-LAP-011
ALR-00484	14h ago	Unusual Outbound Traffic	Medium	Investigating	WS-LAP-011
ALR-00431	16h ago	Suspicious PowerShell Execution	Medium	Resolved	SRV-FILE-01