Suspicious PowerShell Execution

Informational Resolved

ALR-00455 · 2026-10-09T18:52:54Z

Description

Encoded PowerShell command executed on SRV-MAIL-01 by user 'e.evans'. Command attempts to download and execute remote payload. Flagged by Network IDS.

Alert Metadata

Alert ID: ALR-00455
Timestamp: 2026-10-09T18:52:54Z
Severity: Informational
Status: Resolved
Detection Source: Network IDS
Assigned Analyst: EmilyAI (auto)

Endpoint Information

Hostname: SRV-MAIL-01
User Account: e.evans
Source IP: 194.8.62.228
Destination IP: 10.1.14.125
Origin Country: RO Romania

MITRE ATT&CK Mapping

Tactic: Execution
Technique: T1059.001
Reference: attack.mitre.org/techniques/T1059.001

Investigation Timeline

18:52:54 Event ingested by SOC365 Engine

18:52:59 EmilyAI triage started — correlation enrichment

18:52:59 EmilyAI confidence: 91% — escalated to human analyst

18:53:20 Alert assigned to analyst: EmilyAI (auto)

18:55:15 Investigation started — querying SIEM and threat intelligence

18:57:59 Containment action taken — endpoint isolated

19:07:43 Alert resolved — remediation complete

Related Alerts

ID	Time	Alert	Severity	Status	Host
ALR-00127	2h ago	Suspicious PowerShell Execution	Informational	False Positive	WS-PC-006
ALR-00202	4h ago	Suspicious PowerShell Execution	High	Open	SRV-FILE-01
ALR-00132	4h ago	Suspicious PowerShell Execution	Medium	Escalated	WS-LAP-012
ALR-00041	8h ago	Ransomware Behaviour Detected	Low	Open	SRV-MAIL-01
ALR-00277	10h ago	Phishing Email Blocked	Informational	Escalated	SRV-MAIL-01