Suspicious PowerShell Execution

High Escalated

ALR-00354 · 2026-07-11T05:15:14Z

Description

Encoded PowerShell command executed on SRV-DC-01 by user 'h.roberts'. Command attempts to download and execute remote payload. Flagged by Endpoint Agent.

Alert Metadata

Alert ID: ALR-00354
Timestamp: 2026-07-11T05:15:14Z
Severity: High
Status: Escalated
Detection Source: Endpoint Agent
Assigned Analyst: Anika Patel

Endpoint Information

Hostname: SRV-DC-01
User Account: h.roberts
Source IP: 185.191.220.197
Destination IP: 10.2.197.156
Origin Country: RU Russia

MITRE ATT&CK Mapping

Tactic: Execution
Technique: T1059.001
Reference: attack.mitre.org/techniques/T1059.001

Investigation Timeline

05:15:14 Event ingested by SOC365 Engine

05:15:15 EmilyAI triage started — correlation enrichment

05:15:22 EmilyAI confidence: 84% — escalated to human analyst

05:15:35 Alert assigned to analyst: Anika Patel

05:17:51 Investigation started — querying SIEM and threat intelligence

05:22:02 Containment action taken — endpoint isolated

05:25:16 Alert resolved — remediation complete

Related Alerts

ID	Time	Alert	Severity	Status	Host
ALR-00033	3h ago	Suspicious PowerShell Execution	Low	Investigating	WS-PC-001
ALR-00107	6h ago	Unauthorised USB Device	Informational	Investigating	SRV-DC-01
ALR-00007	12h ago	DecoyPulse Honeypot Triggered	Medium	False Positive	SRV-DC-01
ALR-00337	15h ago	Rogue DHCP Server	Low	Escalated	SRV-DC-01
ALR-00209	21h ago	Data Exfiltration Attempt	Low	False Positive	SRV-DC-01