Suspicious Scheduled Task
Low
Escalated
ALR-00167 · 2026-07-10T17:07:18Z
Description
New scheduled task created on WS-PC-004 by 'h.roberts' running encoded batch script at 02:00 daily. No change request on file.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
17:07:18
Event ingested by SOC365 Engine
17:07:20
EmilyAI triage started — correlation enrichment
17:07:33
EmilyAI confidence: 81% — escalated to human analyst
17:07:35
Alert assigned to analyst: EmilyAI (auto)
17:09:01
Investigation started — querying SIEM and threat intelligence
17:14:17
Containment action taken — endpoint isolated
17:20:44
Alert resolved — remediation complete
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00090 | 28m ago | Suspicious Scheduled Task | Informational | False Positive | SRV-APP-01 |
| ALR-00437 | 1h ago | Kerberoasting Attempt | Low | Resolved | WS-PC-004 |
| ALR-00198 | 6h ago | C2 Beacon Activity | Informational | Resolved | WS-PC-004 |
| ALR-00219 | 14h ago | DecoyPulse Honeypot Triggered | Low | Open | WS-PC-004 |
| ALR-00004 | 17h ago | Pass-the-Hash Detected | Low | Resolved | WS-PC-004 |