| splunk |
Windows Remote Access Software BRC4 Loaded Dll |
production |
2026-05-13 |
| splunk |
Windows RDP Server Registry Deletion |
production |
2026-05-13 |
| splunk |
Windows RDP Login Session Was Established |
production |
2026-05-13 |
| splunk |
Windows RDP File Execution |
production |
2026-05-13 |
| splunk |
Windows RDP Connection Successful |
production |
2026-05-13 |
| splunk |
Windows RDP Client Launched with Admin Session |
production |
2026-05-13 |
| splunk |
Windows MSExchange Management Mailbox Cmdlet Usage |
production |
2026-05-13 |
| splunk |
Windows MSC EvilTwin Directory Path Manipulation |
production |
2026-05-13 |
| splunk |
Windows MpCmdRun RemoveDefinitions Execution |
production |
2026-05-13 |
| splunk |
Windows MOVEit Transfer Writing ASPX |
production |
2026-05-13 |
| splunk |
Windows MOF Event Triggered Execution via WMI |
production |
2026-05-13 |
| splunk |
Kubernetes Node Port Creation |
production |
2026-05-13 |
| splunk |
Kubernetes Pod Created in Default Namespace |
production |
2026-05-13 |
| splunk |
Kubernetes Pod With Host Network Attachment |
production |
2026-05-13 |
| splunk |
Kubernetes Previously Unseen Container Image Name |
experimental |
2026-05-13 |
| splunk |
Kubernetes Previously Unseen Process |
experimental |
2026-05-13 |
| splunk |
Trickbot Named Pipe |
production |
2026-05-13 |
| splunk |
Kubernetes Process Running From New Path |
experimental |
2026-05-13 |
| splunk |
Kubernetes Process with Anomalous Resource Utilisation |
experimental |
2026-05-13 |
| splunk |
Kubernetes Process with Resource Ratio Anomalies |
experimental |
2026-05-13 |
| splunk |
Kubernetes Scanner Image Pulling |
production |
2026-05-13 |
| splunk |
Kubernetes Scanning by Unauthenticated IP Address |
production |
2026-05-13 |
| splunk |
Kubernetes Shell Running on Worker Node |
experimental |
2026-05-13 |
| splunk |
O365 Mailbox Folder Read Permission Granted |
production |
2026-05-13 |
| splunk |
O365 Mailbox Inbox Folder Shared with All Users |
production |
2026-05-13 |
| splunk |
O365 Mailbox Read Access Granted to Application |
production |
2026-05-13 |
| splunk |
O365 Multi-Source Failed Authentications Spike |
production |
2026-05-13 |
| splunk |
O365 Multiple AppIDs and UserAgents Authentication Spike |
production |
2026-05-13 |
| splunk |
O365 Multiple Failed MFA Requests For User |
production |
2026-05-13 |
| splunk |
O365 Multiple Mailboxes Accessed via API |
production |
2026-05-13 |
| splunk |
O365 Multiple OS Vendors Authenticating From User |
production |
2026-05-13 |
| splunk |
O365 Multiple Service Principals Created by SP |
production |
2026-05-13 |
| splunk |
O365 Multiple Service Principals Created by User |
production |
2026-05-13 |
| splunk |
O365 Multiple Users Failing To Authenticate From Ip |
production |
2026-05-13 |
| splunk |
O365 New Email Forwarding Rule Created |
production |
2026-05-13 |
| splunk |
O365 New Email Forwarding Rule Enabled |
production |
2026-05-13 |
| splunk |
O365 New Federated Domain Added |
production |
2026-05-13 |
| splunk |
O365 New Forwarding Mailflow Rule Created |
production |
2026-05-13 |
| splunk |
O365 New MFA Method Registered |
production |
2026-05-13 |
| splunk |
O365 OAuth App Mailbox Access via EWS |
production |
2026-05-13 |