Alerts
Raw Defender alerts with evidence, MITRE mapping and timelines.
| Alert | Severity | Status | Category | Device | User | MITRE | ProPera Intel | Created |
|---|---|---|---|---|---|---|---|---|
| Suspicious PowerShell command line (encoded command) | High | New | SuspiciousCommandLine | corp-wks-1187 | j.doe@propera.local | T1059.001 | Suspicious 67.0% | 2026-08-18 20:07 |
| LSASS process access (potential credential dumping) | High | New | CredentialAccess | corp-wks-1187 | j.doe@propera.local | T1003.001T1055 | Unknown 59.0% | 2026-08-18 20:07 |
| Multiple files encrypted with unknown extension | Critical | New | Ransomware | corp-srv-file01 | svc-backup@propera.local | T1486T1490 | Suspicious 64.0% | 2026-08-17 20:07 |
| SMB admin share access from unusual source | High | New | LateralMovement | corp-srv-app02 | svc-backup@propera.local | T1021.002T1570 | Unknown 56.0% | 2026-08-16 20:07 |
| Macro execution from email attachment | Medium | InProgress | Phishing | corp-wks-0421 | m.taylor@propera.local | T1566.001T1204.002 | Unknown 39.0% | 2026-08-15 20:07 |
| Multiple failed logons from single source | Medium | New | BruteForce | corp-dc01 | - | T1110.003 | Unknown 39.0% | 2026-08-13 20:07 |
| Suspicious ASPX file written to web root | High | Resolved | WebShell | corp-srv-app02 | iis_apppool | T1505.003 | Unknown 53.0% | 2026-08-09 20:07 |
