Suspicious PowerShell Execution

Low Investigating

ALR-00418 · 2026-07-05T09:53:06Z

Description

Encoded PowerShell command executed on SRV-MAIL-01 by user 's.jones'. Command attempts to download and execute remote payload. Flagged by Network IDS.

Alert Metadata

Alert ID: ALR-00418
Timestamp: 2026-07-05T09:53:06Z
Severity: Low
Status: Investigating
Detection Source: Network IDS
Assigned Analyst: EmilyAI (auto)

Endpoint Information

Hostname: SRV-MAIL-01
User Account: s.jones
Source IP: 185.194.220.175
Destination IP: 10.0.94.249
Origin Country: NL Netherlands

MITRE ATT&CK Mapping

Tactic: Execution
Technique: T1059.001
Reference: attack.mitre.org/techniques/T1059.001

Investigation Timeline

09:53:06 Event ingested by SOC365 Engine

09:53:11 EmilyAI triage started — correlation enrichment

09:53:18 EmilyAI confidence: 86% — escalated to human analyst

09:53:40 Alert assigned to analyst: EmilyAI (auto)

09:54:52 Investigation started — querying SIEM and threat intelligence

Related Alerts

ID	Time	Alert	Severity	Status	Host
ALR-00261	1d ago	Suspicious PowerShell Execution	Medium	Open	WS-LAP-011
ALR-00449	1d ago	Suspicious PowerShell Execution	Medium	Open	VM-DEV-01
ALR-00351	1d ago	Credential Stuffing Attempt	Low	False Positive	SRV-MAIL-01
ALR-00146	1d ago	Suspicious PowerShell Execution	Medium	Resolved	WS-LAP-012
ALR-00034	2d ago	Phishing Email Blocked	Informational	Escalated	SRV-MAIL-01