Suspicious PowerShell Execution
Low
Resolved
ALR-00128 · 2026-07-09T11:35:19Z
Description
Encoded PowerShell command executed on WS-PC-003 by user 'p.thomas'. Command attempts to download and execute remote payload. Flagged by Dark Web Monitor.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
11:35:19
Event ingested by SOC365 Engine
11:35:20
EmilyAI triage started — correlation enrichment
11:35:34
EmilyAI confidence: 96% — escalated to human analyst
11:36:00
Alert assigned to analyst: EmilyAI (auto)
11:37:46
Investigation started — querying SIEM and threat intelligence
11:39:35
Containment action taken — endpoint isolated
11:49:56
Alert resolved — remediation complete
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00463 | 16h ago | Certificate Anomaly | Low | False Positive | WS-PC-003 |
| ALR-00263 | 19h ago | Suspicious PowerShell Execution | Low | False Positive | SW-CORE-01 |
| ALR-00018 | 21h ago | Shadow IT Discovery | Medium | Open | WS-PC-003 |
| ALR-00488 | 1d ago | Malware Signature Match | Low | False Positive | WS-PC-003 |
| ALR-00400 | 1d ago | Suspicious PowerShell Execution | Medium | Open | WS-PC-004 |