Suspicious PowerShell Execution

Critical Escalated

ALR-00177 · 2026-07-11T17:26:41Z

Description

Encoded PowerShell command executed on VM-DEV-01 by user 'l.johnson'. Command attempts to download and execute remote payload. Flagged by Dark Web Monitor.

Alert Metadata

Alert ID: ALR-00177
Timestamp: 2026-07-11T17:26:41Z
Severity: Critical
Status: Escalated
Detection Source: Dark Web Monitor
Assigned Analyst: Sarah Chen

Endpoint Information

Hostname: VM-DEV-01
User Account: l.johnson
Source IP: 45.59.148.214
Destination IP: 10.2.8.112
Origin Country: VN Vietnam

MITRE ATT&CK Mapping

Tactic: Execution
Technique: T1059.001
Reference: attack.mitre.org/techniques/T1059.001

Investigation Timeline

17:26:41 Event ingested by SOC365 Engine

17:26:45 EmilyAI triage started — correlation enrichment

17:26:47 EmilyAI confidence: 85% — escalated to human analyst

17:27:08 Alert assigned to analyst: Sarah Chen

17:28:31 Investigation started — querying SIEM and threat intelligence

17:35:41 Containment action taken — endpoint isolated

17:39:27 Alert resolved — remediation complete

Related Alerts

ID	Time	Alert	Severity	Status	Host
ALR-00243	2h ago	Suspicious PowerShell Execution	Medium	Open	VM-DEV-01
ALR-00103	3h ago	Suspicious PowerShell Execution	Medium	False Positive	WS-LAP-010
ALR-00258	6h ago	Suspicious Scheduled Task	Low	False Positive	VM-DEV-01
ALR-00359	10h ago	Suspicious PowerShell Execution	High	Open	FW-EDGE-01
ALR-00481	13h ago	Suspicious Scheduled Task	Low	Resolved	VM-DEV-01