Suspicious Scheduled Task
Medium
Resolved
ALR-00452 · 2026-07-06T04:28:15Z
Description
New scheduled task created on SRV-BACKUP-01 by 'f.hall' running encoded batch script at 02:00 daily. No change request on file.
Alert Metadata
Endpoint Information
MITRE ATT&CK Mapping
Investigation Timeline
04:28:15
Event ingested by SOC365 Engine
04:28:17
EmilyAI triage started — correlation enrichment
04:28:26
EmilyAI confidence: 79% — escalated to human analyst
04:28:59
Alert assigned to analyst: James Okonkwo
04:29:53
Investigation started — querying SIEM and threat intelligence
04:31:38
Containment action taken — endpoint isolated
04:46:39
Alert resolved — remediation complete
Related Alerts
| ID | Time | Alert | Severity | Status | Host |
|---|---|---|---|---|---|
| ALR-00217 | 1h ago | Tor Exit Node Connection | High | Investigating | SRV-BACKUP-01 |
| ALR-00408 | 20h ago | Failed MFA Challenge | Informational | False Positive | SRV-BACKUP-01 |
| ALR-00196 | 1d ago | Suspicious Scheduled Task | Medium | Open | SRV-SQL-01 |
| ALR-00261 | 1d ago | Suspicious Scheduled Task | Low | Escalated | WS-PC-003 |
| ALR-00410 | 1d ago | Unauthorised USB Device | Informational | Resolved | SRV-BACKUP-01 |