Suspicious PowerShell Execution

Medium Investigating

ALR-00410 · 2026-10-11T07:34:14Z

Description

Encoded PowerShell command executed on WS-PC-001 by user 'm.taylor'. Command attempts to download and execute remote payload. Flagged by EmilyAI Triage.

Alert Metadata

Alert ID: ALR-00410
Timestamp: 2026-10-11T07:34:14Z
Severity: Medium
Status: Investigating
Detection Source: EmilyAI Triage
Assigned Analyst: Sarah Chen

Endpoint Information

Hostname: WS-PC-001
User Account: m.taylor
Source IP: 91.34.195.49
Destination IP: 10.0.78.2
Origin Country: IN India

MITRE ATT&CK Mapping

Tactic: Execution
Technique: T1059.001
Reference: attack.mitre.org/techniques/T1059.001

Investigation Timeline

07:34:14 Event ingested by SOC365 Engine

07:34:17 EmilyAI triage started — correlation enrichment

07:34:24 EmilyAI confidence: 93% — escalated to human analyst

07:34:57 Alert assigned to analyst: Sarah Chen

07:36:06 Investigation started — querying SIEM and threat intelligence

Related Alerts

ID	Time	Alert	Severity	Status	Host
ALR-00448	20m ago	Suspicious PowerShell Execution	Low	False Positive	SRV-SQL-01
ALR-00354	1h ago	Suspicious PowerShell Execution	Critical	Escalated	WS-PC-002
ALR-00468	4h ago	Insider Threat Indicator	Low	False Positive	WS-PC-001
ALR-00080	5h ago	Suspicious PowerShell Execution	Medium	Escalated	WS-LAP-010
ALR-00114	6h ago	Suspicious PowerShell Execution	Informational	Open	SRV-DC-01