Suspicious PowerShell Execution

Informational Investigating

ALR-00181 · 2026-10-07T05:07:18Z

Description

Encoded PowerShell command executed on WS-MAC-005 by user 'e.evans'. Command attempts to download and execute remote payload. Flagged by Email Gateway.

Alert Metadata

Alert ID: ALR-00181
Timestamp: 2026-10-07T05:07:18Z
Severity: Informational
Status: Investigating
Detection Source: Email Gateway
Assigned Analyst: EmilyAI (auto)

Endpoint Information

Hostname: WS-MAC-005
User Account: e.evans
Source IP: 194.63.62.98
Destination IP: 10.1.28.197
Origin Country: NL Netherlands

MITRE ATT&CK Mapping

Tactic: Execution
Technique: T1059.001
Reference: attack.mitre.org/techniques/T1059.001

Investigation Timeline

05:07:18 Event ingested by SOC365 Engine

05:07:19 EmilyAI triage started — correlation enrichment

05:07:23 EmilyAI confidence: 81% — escalated to human analyst

05:07:35 Alert assigned to analyst: EmilyAI (auto)

05:08:39 Investigation started — querying SIEM and threat intelligence

Related Alerts

ID	Time	Alert	Severity	Status	Host
ALR-00448	20m ago	Suspicious PowerShell Execution	Low	False Positive	SRV-SQL-01
ALR-00354	1h ago	Suspicious PowerShell Execution	Critical	Escalated	WS-PC-002
ALR-00080	5h ago	Suspicious PowerShell Execution	Medium	Escalated	WS-LAP-010
ALR-00114	6h ago	Suspicious PowerShell Execution	Informational	Open	SRV-DC-01
ALR-00416	8h ago	Privilege Escalation Attempt	Low	Open	WS-MAC-005