Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 04:43:05 UTC

Suspicious Scheduled Task

Informational Investigating
ALR-00239 · 2026-10-08T07:22:18Z

Description

New scheduled task created on SRV-BACKUP-01 by 'h.roberts' running encoded batch script at 02:00 daily. No change request on file.

Alert Metadata

Alert ID
ALR-00239
Timestamp
2026-10-08T07:22:18Z
Severity
Informational
Status
Investigating
Detection Source
SOC365 Engine
Assigned Analyst
EmilyAI (auto)

Endpoint Information

Hostname
SRV-BACKUP-01
User Account
h.roberts
Source IP
103.24.216.102
Destination IP
10.2.236.2
Origin Country
KP North Korea

MITRE ATT&CK Mapping

Tactic
Persistence
Technique
T1053.005
Reference
attack.mitre.org/techniques/T1053.005

Investigation Timeline

07:22:18 Event ingested by SOC365 Engine
07:22:21 EmilyAI triage started — correlation enrichment
07:22:30 EmilyAI confidence: 89% — escalated to human analyst
07:22:57 Alert assigned to analyst: EmilyAI (auto)
07:25:17 Investigation started — querying SIEM and threat intelligence

Related Alerts

ID Time Alert Severity Status Host
ALR-00460 6h ago Anomalous DNS Query Low Resolved SRV-BACKUP-01
ALR-00284 9h ago Certificate Anomaly Low False Positive SRV-BACKUP-01
ALR-00042 10h ago Suspicious Scheduled Task Medium Open FW-EDGE-01
ALR-00082 12h ago Suspicious Scheduled Task Informational Open SRV-APP-01
ALR-00075 19h ago Suspicious Scheduled Task High Escalated VM-DEV-01