Suspicious PowerShell Execution

High Escalated

ALR-00220 · 2026-10-11T23:46:48Z

Description

Encoded PowerShell command executed on SRV-SQL-01 by user 'k.brown'. Command attempts to download and execute remote payload. Flagged by Endpoint Agent.

Alert Metadata

Alert ID: ALR-00220
Timestamp: 2026-10-11T23:46:48Z
Severity: High
Status: Escalated
Detection Source: Endpoint Agent
Assigned Analyst: Marcus Webb

Endpoint Information

Hostname: SRV-SQL-01
User Account: k.brown
Source IP: 91.74.195.101
Destination IP: 10.3.228.163
Origin Country: NG Nigeria

MITRE ATT&CK Mapping

Tactic: Execution
Technique: T1059.001
Reference: attack.mitre.org/techniques/T1059.001

Investigation Timeline

23:46:48 Event ingested by SOC365 Engine

23:46:49 EmilyAI triage started — correlation enrichment

23:46:57 EmilyAI confidence: 95% — escalated to human analyst

23:47:13 Alert assigned to analyst: Marcus Webb

23:47:41 Investigation started — querying SIEM and threat intelligence

23:53:51 Containment action taken — endpoint isolated

00:02:29 Alert resolved — remediation complete

Related Alerts

ID	Time	Alert	Severity	Status	Host
ALR-00494	4h ago	Suspicious PowerShell Execution	Medium	False Positive	SRV-SQL-01
ALR-00429	1d ago	Anomalous DNS Query	Medium	Investigating	SRV-SQL-01
ALR-00121	1d ago	Tor Exit Node Connection	Low	False Positive	SRV-SQL-01
ALR-00161	1d ago	Suspicious PowerShell Execution	Low	False Positive	WS-MAC-005
ALR-00315	1d ago	Suspicious PowerShell Execution	Medium	Investigating	AP-WIFI-03