Suspicious Scheduled Task
Medium
Investigating
ALR-00279 · 2026-07-09T09:04:51Z
Description
New scheduled task created on SRV-MAIL-01 by 'd.walker' running encoded batch script at 02:00 daily. No change request on file.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
09:04:51
Event ingested by SOC365 Engine
09:04:55
EmilyAI triage started — correlation enrichment
09:04:58
EmilyAI confidence: 84% — escalated to human analyst
09:05:29
Alert assigned to analyst: James Okonkwo
09:05:59
Investigation started — querying SIEM and threat intelligence
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00423 | 2h ago | Suspicious Scheduled Task | High | Open | SRV-BACKUP-01 |
| ALR-00258 | 6h ago | Suspicious Scheduled Task | Low | False Positive | VM-DEV-01 |
| ALR-00018 | 6h ago | Shadow IT Discovery | Low | Escalated | SRV-MAIL-01 |
| ALR-00095 | 12h ago | Tor Exit Node Connection | Low | Open | SRV-MAIL-01 |
| ALR-00481 | 13h ago | Suspicious Scheduled Task | Low | Resolved | VM-DEV-01 |