Suspicious PowerShell Execution
High
Open
ALR-00131 · 2026-10-08T22:27:00Z
Description
Encoded PowerShell command executed on SRV-WEB-01 by user 'e.evans'. Command attempts to download and execute remote payload. Flagged by DLP Module.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
22:27:00
Event ingested by SOC365 Engine
22:27:02
EmilyAI triage started — correlation enrichment
22:27:14
EmilyAI confidence: 80% — escalated to human analyst
22:27:33
Alert assigned to analyst: James Okonkwo
22:27:46
Investigation started — querying SIEM and threat intelligence
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00448 | 20m ago | Suspicious PowerShell Execution | Low | False Positive | SRV-SQL-01 |
| ALR-00497 | 35m ago | Unusual Outbound Traffic | Medium | Investigating | SRV-WEB-01 |
| ALR-00354 | 1h ago | Suspicious PowerShell Execution | Critical | Escalated | WS-PC-002 |
| ALR-00080 | 5h ago | Suspicious PowerShell Execution | Medium | Escalated | WS-LAP-010 |
| ALR-00114 | 6h ago | Suspicious PowerShell Execution | Informational | Open | SRV-DC-01 |