Suspicious PowerShell Execution
Low
False Positive
ALR-00117 · 2026-07-10T12:49:22Z
Description
Encoded PowerShell command executed on WS-LAP-011 by user 'e.evans'. Command attempts to download and execute remote payload. Flagged by Endpoint Agent.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
12:49:22
Event ingested by SOC365 Engine
12:49:23
EmilyAI triage started — correlation enrichment
12:49:30
EmilyAI confidence: 86% — escalated to human analyst
12:50:02
Alert assigned to analyst: EmilyAI (auto)
12:51:59
Investigation started — querying SIEM and threat intelligence
12:57:33
Containment action taken — endpoint isolated
13:03:43
Alert resolved — remediation complete
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00262 | 36m ago | C2 Beacon Activity | Low | False Positive | WS-LAP-011 |
| ALR-00062 | 4h ago | Anomalous DNS Query | Informational | Resolved | WS-LAP-011 |
| ALR-00107 | 12h ago | Suspicious Scheduled Task | Low | Resolved | WS-LAP-011 |
| ALR-00484 | 14h ago | Unusual Outbound Traffic | Medium | Investigating | WS-LAP-011 |
| ALR-00431 | 16h ago | Suspicious PowerShell Execution | Medium | Resolved | SRV-FILE-01 |