| splunk |
Windows Unusual NTLM Authentication Destinations By Source |
production |
2026-05-13 |
| splunk |
Windows Unusual NTLM Authentication Destinations By User |
production |
2026-05-13 |
| splunk |
Windows Unusual NTLM Authentication Users By Destination |
production |
2026-05-13 |
| splunk |
Windows Unusual NTLM Authentication Users By Source |
production |
2026-05-13 |
| splunk |
Windows USBSTOR Registry Key Modification |
production |
2026-05-13 |
| splunk |
Windows User Deletion Via Net |
production |
2026-05-13 |
| splunk |
Windows User Disabled Via Net |
production |
2026-05-13 |
| splunk |
Windows User Execution Malicious URL Shortcut File |
production |
2026-05-13 |
| splunk |
Windows Visual Basic Commandline Compiler DNSQuery |
production |
2026-05-13 |
| splunk |
Windows Vulnerable 3CX Software |
production |
2026-05-13 |
| splunk |
Windows WBAdmin File Recovery From Backup |
production |
2026-05-13 |
| splunk |
Windows WinDBG Spawning AutoIt3 |
production |
2026-05-13 |
| splunk |
Windows WinLogon with Public Network Connection |
production |
2026-05-13 |
| splunk |
Windows WinPEAS PowerShell Script Execution |
production |
2026-05-13 |
| splunk |
Windows WinRAR Launched Outside Default Installation Directory |
production |
2026-05-13 |
| splunk |
Windows PowerShell WMI Win32 ScheduledJob |
production |
2026-05-13 |
| splunk |
Cisco Secure Firewall - Communication Over Suspicious Ports |
production |
2026-05-13 |
| splunk |
Cisco Secure Firewall - Connection to File Sharing Domain |
production |
2026-05-13 |
| splunk |
Cisco Secure Firewall - High EVE Threat Confidence |
production |
2026-05-13 |
| splunk |
Cisco Secure Firewall - High Priority Intrusion Classification |
production |
2026-05-13 |
| splunk |
Internal Vulnerability Scan |
experimental |
2026-05-13 |
| splunk |
Cisco Secure Firewall - High Volume of Intrusion Events Per Host |
production |
2026-05-13 |
| splunk |
Cisco Secure Firewall - Lumma Stealer Activity |
production |
2026-05-13 |
| splunk |
Cisco Secure Firewall - Lumma Stealer Download Attempt |
production |
2026-05-13 |
| splunk |
Cisco Secure Firewall - Lumma Stealer Outbound Connection Attempt |
production |
2026-05-13 |
| splunk |
Cisco Secure Firewall - Oracle E-Business Suite Correlation |
production |
2026-05-13 |
| splunk |
Cisco Secure Firewall - Oracle E-Business Suite Exploitation |
production |
2026-05-13 |
| splunk |
Cisco Secure Firewall - Possibly Compromised Host |
experimental |
2026-05-13 |
| splunk |
Cisco Secure Firewall - Potential Data Exfiltration |
production |
2026-05-13 |
| splunk |
Cisco Secure Firewall - Privileged Command Execution via HTTP |
production |
2026-05-13 |
| splunk |
Cisco Secure Firewall - Rare Snort Rule Triggered |
production |
2026-05-13 |
| splunk |
Cisco Secure Firewall - React Server Components RCE Attempt |
production |
2026-05-13 |
| splunk |
Cisco Secure Firewall - Repeated Blocked Connections |
production |
2026-05-13 |
| splunk |
Cisco Secure Firewall - Snort Rule Triggered Across Multiple Hosts |
production |
2026-05-13 |
| splunk |
Windows PowerShell Script From WindowsApps Directory |
production |
2026-05-13 |
| splunk |
Cisco Secure Firewall - SSH Connection to Non-Standard Port |
production |
2026-05-13 |
| splunk |
Cisco Secure Firewall - SSH Connection to sshd_operns |
production |
2026-05-13 |
| splunk |
Cisco Secure Firewall - Static Tundra Smart Install Abuse |
production |
2026-05-13 |
| splunk |
Cisco Secure Firewall - Veeam CVE-2023-27532 Exploitation Activity |
production |
2026-05-13 |
| splunk |
Cisco Secure Firewall - Wget or Curl Download |
production |
2026-05-13 |