Suspicious PowerShell Execution

Low Resolved

ALR-00128 · 2026-07-09T11:35:19Z

Description

Encoded PowerShell command executed on WS-PC-003 by user 'p.thomas'. Command attempts to download and execute remote payload. Flagged by Dark Web Monitor.

Alert Metadata

Alert ID: ALR-00128
Timestamp: 2026-07-09T11:35:19Z
Severity: Low
Status: Resolved
Detection Source: Dark Web Monitor
Assigned Analyst: EmilyAI (auto)

Endpoint Information

Hostname: WS-PC-003
User Account: p.thomas
Source IP: 103.158.216.94
Destination IP: 10.3.42.75
Origin Country: US United States

MITRE ATT&CK Mapping

Tactic: Execution
Technique: T1059.001
Reference: attack.mitre.org/techniques/T1059.001

Investigation Timeline

11:35:19 Event ingested by SOC365 Engine

11:35:20 EmilyAI triage started — correlation enrichment

11:35:34 EmilyAI confidence: 96% — escalated to human analyst

11:36:00 Alert assigned to analyst: EmilyAI (auto)

11:37:46 Investigation started — querying SIEM and threat intelligence

11:39:35 Containment action taken — endpoint isolated

11:49:56 Alert resolved — remediation complete

Related Alerts

ID	Time	Alert	Severity	Status	Host
ALR-00463	16h ago	Certificate Anomaly	Low	False Positive	WS-PC-003
ALR-00263	19h ago	Suspicious PowerShell Execution	Low	False Positive	SW-CORE-01
ALR-00018	21h ago	Shadow IT Discovery	Medium	Open	WS-PC-003
ALR-00488	1d ago	Malware Signature Match	Low	False Positive	WS-PC-003
ALR-00400	1d ago	Suspicious PowerShell Execution	Medium	Open	WS-PC-004