Suspicious PowerShell Execution

Informational Open

ALR-00458 · 2026-10-11T20:58:10Z

Description

Encoded PowerShell command executed on WS-PC-001 by user 'r.davies'. Command attempts to download and execute remote payload. Flagged by EmilyAI Triage.

Alert Metadata

Alert ID: ALR-00458
Timestamp: 2026-10-11T20:58:10Z
Severity: Informational
Status: Open
Detection Source: EmilyAI Triage
Assigned Analyst: EmilyAI (auto)

Endpoint Information

Hostname: WS-PC-001
User Account: r.davies
Source IP: 185.65.220.115
Destination IP: 10.1.218.169
Origin Country: IR Iran

MITRE ATT&CK Mapping

Tactic: Execution
Technique: T1059.001
Reference: attack.mitre.org/techniques/T1059.001

Investigation Timeline

20:58:10 Event ingested by SOC365 Engine

20:58:14 EmilyAI triage started — correlation enrichment

20:58:21 EmilyAI confidence: 81% — escalated to human analyst

20:58:41 Alert assigned to analyst: EmilyAI (auto)

20:58:57 Investigation started — querying SIEM and threat intelligence

Related Alerts

ID	Time	Alert	Severity	Status	Host
ALR-00014	48m ago	Suspicious PowerShell Execution	Medium	Open	WS-PC-002
ALR-00107	4h ago	Shadow IT Discovery	Medium	Escalated	WS-PC-001
ALR-00130	5h ago	Insider Threat Indicator	Low	Resolved	WS-PC-001
ALR-00078	10h ago	Suspicious PowerShell Execution	Low	Open	WS-LAP-012
ALR-00499	11h ago	Credential Stuffing Attempt	High	Open	WS-PC-001