| splunk |
O365 Mail Permissioned Application Consent Granted by User |
production |
2026-05-13 |
| splunk |
O365 Mailbox Email Forwarding Enabled |
production |
2026-05-13 |
| splunk |
O365 Mailbox Folder Read Permission Assigned |
production |
2026-05-13 |
| splunk |
Allow Network Discovery In Firewall |
production |
2026-05-13 |
| splunk |
Allow Operation with Consent Admin |
production |
2026-05-13 |
| splunk |
Anomalous usage of 7zip |
production |
2026-05-13 |
| splunk |
Auto Admin Logon Registry Entry |
production |
2026-05-13 |
| splunk |
Bcdedit Command Back To Normal Mode Boot |
production |
2026-05-13 |
| splunk |
BCDEdit Failure Recovery Modification |
production |
2026-05-13 |
| splunk |
BITS Job Persistence |
production |
2026-05-13 |
| splunk |
BITSAdmin Download File |
production |
2026-05-13 |
| splunk |
Certutil exe certificate extraction |
production |
2026-05-13 |
| splunk |
CertUtil With Decode Argument |
production |
2026-05-13 |
| splunk |
Change To Safe Mode With Network Config |
production |
2026-05-13 |
| splunk |
Check Elevated CMD using whoami |
production |
2026-05-13 |
| splunk |
Cisco Isovalent - Access To Cloud Metadata Service |
production |
2026-05-13 |
| splunk |
Cisco Isovalent - Cron Job Creation |
production |
2026-05-13 |
| splunk |
Cisco Isovalent - Curl Execution With Insecure Flags |
production |
2026-05-13 |
| splunk |
Cisco Isovalent - Kprobe Spike |
production |
2026-05-13 |
| splunk |
Cisco Isovalent - Late Process Execution |
production |
2026-05-13 |
| splunk |
Cisco Isovalent - Non Allowlisted Image Use |
production |
2026-05-13 |
| splunk |
Cisco Isovalent - Nsenter Usage in Kubernetes Pod |
production |
2026-05-13 |
| splunk |
Cisco Isovalent - Pods Running Offensive Tools |
production |
2026-05-13 |
| splunk |
Cisco Isovalent - Potential Escape to Host |
production |
2026-05-13 |
| splunk |
Cisco Isovalent - Shell Execution |
production |
2026-05-13 |
| splunk |
Crowdstrike Medium Identity Risk Severity |
production |
2026-05-13 |
| splunk |
Clear Unallocated Sector Using Cipher App |
production |
2026-05-13 |
| splunk |
Clop Common Exec Parameter |
production |
2026-05-13 |
| splunk |
Clop Ransomware Known Service Name |
production |
2026-05-13 |
| splunk |
CMD Carry Out String Command Parameter |
production |
2026-05-13 |
| splunk |
CMD Echo Pipe - Escalation |
production |
2026-05-13 |
| splunk |
CMLUA Or CMSTPLUA UAC Bypass |
production |
2026-05-13 |
| splunk |
ConnectWise ScreenConnect Path Traversal |
production |
2026-05-13 |
| splunk |
ConnectWise ScreenConnect Path Traversal Windows SACL |
production |
2026-05-13 |
| splunk |
Conti Common Exec parameter |
production |
2026-05-13 |
| splunk |
Control Loading from World Writable Directory |
production |
2026-05-13 |
| splunk |
Create or delete windows shares using net exe |
production |
2026-05-13 |
| splunk |
Creation of Shadow Copy |
production |
2026-05-13 |
| splunk |
Creation of Shadow Copy with wmic and powershell |
production |
2026-05-13 |
| splunk |
Credential Dumping via Copy Command from Shadow Copy |
production |
2026-05-13 |