Suspicious PowerShell Execution

High Escalated

ALR-00324 · 2026-07-05T20:19:24Z

Description

Encoded PowerShell command executed on AP-WIFI-03 by user 'n.clark'. Command attempts to download and execute remote payload. Flagged by Email Gateway.

Alert Metadata

Alert ID: ALR-00324
Timestamp: 2026-07-05T20:19:24Z
Severity: High
Status: Escalated
Detection Source: Email Gateway
Assigned Analyst: Anika Patel

Endpoint Information

Hostname: AP-WIFI-03
User Account: n.clark
Source IP: 185.71.220.219
Destination IP: 10.1.29.184
Origin Country: CN China

MITRE ATT&CK Mapping

Tactic: Execution
Technique: T1059.001
Reference: attack.mitre.org/techniques/T1059.001

Investigation Timeline

20:19:24 Event ingested by SOC365 Engine

20:19:26 EmilyAI triage started — correlation enrichment

20:19:36 EmilyAI confidence: 95% — escalated to human analyst

20:20:06 Alert assigned to analyst: Anika Patel

20:20:58 Investigation started — querying SIEM and threat intelligence

20:22:55 Containment action taken — endpoint isolated

20:33:10 Alert resolved — remediation complete

Related Alerts

ID	Time	Alert	Severity	Status	Host
ALR-00196	28m ago	Port Scan Detected	Medium	Resolved	AP-WIFI-03
ALR-00194	58m ago	Suspicious PowerShell Execution	Informational	False Positive	WS-LAP-011
ALR-00470	21h ago	Phishing Email Blocked	Informational	Open	AP-WIFI-03
ALR-00068	22h ago	Suspicious PowerShell Execution	Low	Investigating	SRV-APP-01
ALR-00163	1d ago	Suspicious PowerShell Execution	High	Investigating	SRV-SQL-01