Suspicious PowerShell encoded command
corp-eng-22 · d.silva · representative alert
Critical
199 suppressed
Untitled timeline
199 events
Save
host.name: "corp-eng-22"
user.name: "d.silva"
Suppressed source events from the selected alert
powershell.exe -EncodedCommand … -WindowStyle hidden09:21:03.900
powershell.exe -EncodedCommand … -WindowStyle hidden09:21:04.412
Outbound connection to 194.61.24.9:44309:21:05.108
powershell.exe -EncodedCommand … -WindowStyle hidden09:21:06.590
Showing 4 of 199 source events