Interactive Demo — Simulated data only. Back to SOC in a Box
SOC365 Dashboard
Acme Legal Services Ltd Live 03:42:48 UTC

Suspicious PowerShell Execution

Medium Open
ALR-00411 · 2026-10-11T10:05:47Z

Description

Encoded PowerShell command executed on WS-LAP-011 by user 'j.smith'. Command attempts to download and execute remote payload. Flagged by Network IDS.

Alert Metadata

Alert ID
ALR-00411
Timestamp
2026-10-11T10:05:47Z
Severity
Medium
Status
Open
Detection Source
Network IDS
Assigned Analyst
Emma Richardson

Endpoint Information

Hostname
WS-LAP-011
User Account
j.smith
Source IP
185.135.220.159
Destination IP
10.2.141.39
Origin Country
IR Iran

MITRE ATT&CK Mapping

Tactic
Execution
Technique
T1059.001
Reference
attack.mitre.org/techniques/T1059.001

Investigation Timeline

10:05:47 Event ingested by SOC365 Engine
10:05:51 EmilyAI triage started — correlation enrichment
10:06:00 EmilyAI confidence: 82% — escalated to human analyst
10:06:14 Alert assigned to analyst: Emma Richardson
10:07:42 Investigation started — querying SIEM and threat intelligence

Related Alerts

ID Time Alert Severity Status Host
ALR-00072 3h ago Suspicious PowerShell Execution Low False Positive VM-DEV-01
ALR-00112 6h ago Kerberoasting Attempt Low Escalated WS-LAP-011
ALR-00275 10h ago Kerberoasting Attempt Low Open WS-LAP-011
ALR-00136 10h ago Suspicious PowerShell Execution Low Escalated WS-PC-006
ALR-00345 13h ago Phishing Email Blocked Informational Open WS-LAP-011