Suspicious PowerShell Execution

Low Investigating

ALR-00142 · 2026-07-08T22:46:23Z

Description

Encoded PowerShell command executed on VM-DEV-01 by user 'r.davies'. Command attempts to download and execute remote payload. Flagged by Dark Web Monitor.

Alert Metadata

Alert ID: ALR-00142
Timestamp: 2026-07-08T22:46:23Z
Severity: Low
Status: Investigating
Detection Source: Dark Web Monitor
Assigned Analyst: EmilyAI (auto)

Endpoint Information

Hostname: VM-DEV-01
User Account: r.davies
Source IP: 45.3.148.78
Destination IP: 10.0.132.83
Origin Country: FR France

MITRE ATT&CK Mapping

Tactic: Execution
Technique: T1059.001
Reference: attack.mitre.org/techniques/T1059.001

Investigation Timeline

22:46:23 Event ingested by SOC365 Engine

22:46:24 EmilyAI triage started — correlation enrichment

22:46:38 EmilyAI confidence: 78% — escalated to human analyst

22:46:52 Alert assigned to analyst: EmilyAI (auto)

22:48:18 Investigation started — querying SIEM and threat intelligence

Related Alerts

ID	Time	Alert	Severity	Status	Host
ALR-00364	1h ago	Suspicious PowerShell Execution	Medium	Open	SRV-DC-01
ALR-00178	4h ago	Suspicious Scheduled Task	Low	Investigating	VM-DEV-01
ALR-00141	6h ago	Suspicious PowerShell Execution	Informational	False Positive	SRV-FILE-01
ALR-00060	11h ago	Insider Threat Indicator	Medium	Escalated	VM-DEV-01
ALR-00210	17h ago	Suspicious PowerShell Execution	Low	Investigating	WS-LAP-010