Suspicious PowerShell Execution
Critical
Escalated
ALR-00177 · 2026-07-11T17:26:41Z
Description
Encoded PowerShell command executed on VM-DEV-01 by user 'l.johnson'. Command attempts to download and execute remote payload. Flagged by Dark Web Monitor.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
17:26:41
Event ingested by SOC365 Engine
17:26:45
EmilyAI triage started — correlation enrichment
17:26:47
EmilyAI confidence: 85% — escalated to human analyst
17:27:08
Alert assigned to analyst: Sarah Chen
17:28:31
Investigation started — querying SIEM and threat intelligence
17:35:41
Containment action taken — endpoint isolated
17:39:27
Alert resolved — remediation complete
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00243 | 2h ago | Suspicious PowerShell Execution | Medium | Open | VM-DEV-01 |
| ALR-00103 | 3h ago | Suspicious PowerShell Execution | Medium | False Positive | WS-LAP-010 |
| ALR-00258 | 6h ago | Suspicious Scheduled Task | Low | False Positive | VM-DEV-01 |
| ALR-00359 | 10h ago | Suspicious PowerShell Execution | High | Open | FW-EDGE-01 |
| ALR-00481 | 13h ago | Suspicious Scheduled Task | Low | Resolved | VM-DEV-01 |