Attack Timeline

Malicious attachment identified in email from external sender

PowerShell spawned from Outlook process

Automated response killed suspicious PowerShell process

LSASS memory access detected from unknown process

Multiple high-severity detections triggered SOC escalation

Workstation-15 isolated from network pending investigation