Suspicious PowerShell Execution

Low Open

ALR-00273 · 2026-10-05T12:19:35Z

Description

Encoded PowerShell command executed on SRV-MAIL-01 by user 'k.brown'. Command attempts to download and execute remote payload. Flagged by Cloud Connector.

Alert Metadata

Alert ID: ALR-00273
Timestamp: 2026-10-05T12:19:35Z
Severity: Low
Status: Open
Detection Source: Cloud Connector
Assigned Analyst: EmilyAI (auto)

Endpoint Information

Hostname: SRV-MAIL-01
User Account: k.brown
Source IP: 91.114.195.90
Destination IP: 10.0.158.244
Origin Country: KP North Korea

MITRE ATT&CK Mapping

Tactic: Execution
Technique: T1059.001
Reference: attack.mitre.org/techniques/T1059.001

Investigation Timeline

12:19:35 Event ingested by SOC365 Engine

12:19:40 EmilyAI triage started — correlation enrichment

12:19:43 EmilyAI confidence: 88% — escalated to human analyst

12:20:09 Alert assigned to analyst: EmilyAI (auto)

12:20:25 Investigation started — querying SIEM and threat intelligence

Related Alerts

ID	Time	Alert	Severity	Status	Host
ALR-00170	4h ago	Lateral Movement Detected	High	Open	SRV-MAIL-01
ALR-00190	8h ago	Suspicious PowerShell Execution	Low	Open	WS-LAP-010
ALR-00449	10h ago	Unauthorised USB Device	Medium	Investigating	SRV-MAIL-01
ALR-00367	19h ago	Phishing Email Blocked	Medium	Escalated	SRV-MAIL-01
ALR-00411	1d ago	Suspicious PowerShell Execution	High	Investigating	SW-CORE-01