Suspicious PowerShell Execution

Informational Escalated

ALR-00350 · 2026-10-06T07:22:47Z

Description

Encoded PowerShell command executed on WS-LAP-011 by user 'c.williams'. Command attempts to download and execute remote payload. Flagged by EmilyAI Triage.

Alert Metadata

Alert ID: ALR-00350
Timestamp: 2026-10-06T07:22:47Z
Severity: Informational
Status: Escalated
Detection Source: EmilyAI Triage
Assigned Analyst: EmilyAI (auto)

Endpoint Information

Hostname: WS-LAP-011
User Account: c.williams
Source IP: 45.70.148.151
Destination IP: 10.1.24.188
Origin Country: CN China

MITRE ATT&CK Mapping

Tactic: Execution
Technique: T1059.001
Reference: attack.mitre.org/techniques/T1059.001

Investigation Timeline

07:22:47 Event ingested by SOC365 Engine

07:22:51 EmilyAI triage started — correlation enrichment

07:22:52 EmilyAI confidence: 80% — escalated to human analyst

07:23:09 Alert assigned to analyst: EmilyAI (auto)

07:25:06 Investigation started — querying SIEM and threat intelligence

07:30:47 Containment action taken — endpoint isolated

07:34:54 Alert resolved — remediation complete

Related Alerts

ID	Time	Alert	Severity	Status	Host
ALR-00481	2h ago	Failed MFA Challenge	High	Open	WS-LAP-011
ALR-00381	22h ago	Suspicious PowerShell Execution	Informational	False Positive	VM-DEV-01
ALR-00206	23h ago	Tor Exit Node Connection	Medium	Resolved	WS-LAP-011
ALR-00215	23h ago	Suspicious PowerShell Execution	Informational	Resolved	SRV-FILE-01
ALR-00352	1d ago	Port Scan Detected	Medium	Resolved	WS-LAP-011