Suspicious Scheduled Task
Medium
False Positive
ALR-00274 · 2026-07-06T11:51:42Z
Description
New scheduled task created on SW-CORE-01 by 'p.thomas' running encoded batch script at 02:00 daily. No change request on file.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
11:51:42
Event ingested by SOC365 Engine
11:51:47
EmilyAI triage started — correlation enrichment
11:51:51
EmilyAI confidence: 96% — escalated to human analyst
11:52:09
Alert assigned to analyst: Marcus Webb
11:53:00
Investigation started — querying SIEM and threat intelligence
11:57:10
Containment action taken — endpoint isolated
12:07:33
Alert resolved — remediation complete
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00349 | 1h ago | Suspicious Scheduled Task | Medium | Open | WS-PC-002 |
| ALR-00453 | 2h ago | Suspicious PowerShell Execution | Low | Open | SW-CORE-01 |
| ALR-00412 | 2h ago | Lateral Movement Detected | Medium | Investigating | SW-CORE-01 |
| ALR-00294 | 3h ago | Unusual Outbound Traffic | Medium | Resolved | SW-CORE-01 |
| ALR-00204 | 11h ago | Suspicious Scheduled Task | Medium | False Positive | WS-PC-006 |