Suspicious PowerShell Execution
Low
Open
ALR-00242 · 2026-04-11T15:55:34Z
Description
Encoded PowerShell command executed on SRV-WEB-01 by user 'f.hall'. Command attempts to download and execute remote payload. Flagged by DecoyPulse.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
15:55:34
Event ingested by SOC365 Engine
15:55:35
EmilyAI triage started — correlation enrichment
15:55:45
EmilyAI confidence: 95% — escalated to human analyst
15:56:03
Alert assigned to analyst: EmilyAI (auto)
15:57:32
Investigation started — querying SIEM and threat intelligence
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00308 | 8h ago | Malware Signature Match | Low | Escalated | SRV-WEB-01 |
| ALR-00058 | 9h ago | Ransomware Behaviour Detected | High | Investigating | SRV-WEB-01 |
| ALR-00390 | 13h ago | Rogue DHCP Server | Low | Investigating | SRV-WEB-01 |
| ALR-00377 | 17h ago | Suspicious PowerShell Execution | Informational | Open | SRV-MAIL-01 |
| ALR-00049 | 17h ago | Suspicious PowerShell Execution | Medium | False Positive | WS-LAP-012 |