| splunk |
Remote Process Instantiation via DCOM and PowerShell Script Block |
production |
2026-05-13 |
| splunk |
Remote Process Instantiation via DCOM and PowerShell |
production |
2026-05-13 |
| splunk |
Remote Desktop Process Running On System |
experimental |
2026-05-13 |
| splunk |
Remcos RAT File Creation in Remcos Folder |
production |
2026-05-13 |
| splunk |
Remcos client registry install entry |
production |
2026-05-13 |
| splunk |
Registry Keys Used For Privilege Escalation |
production |
2026-05-13 |
| splunk |
Registry Keys for Creating SHIM Databases |
production |
2026-05-13 |
| splunk |
Reg exe Manipulating Windows Services Registry Keys |
production |
2026-05-13 |
| splunk |
Recursive Delete of Directory In Batch CMD |
production |
2026-05-13 |
| splunk |
Recon Using WMI Class |
production |
2026-05-13 |
| splunk |
Ransomware Notes bulk creation |
production |
2026-05-13 |
| splunk |
Randomly Generated Windows Service Name |
experimental |
2026-05-13 |
| splunk |
Randomly Generated Scheduled Task Name |
experimental |
2026-05-13 |
| splunk |
Processes Tapping Keyboard Events |
experimental |
2026-05-13 |
| splunk |
Process Writing DynamicWrapperX |
production |
2026-05-13 |
| splunk |
Process Kill Base On File Path |
production |
2026-05-13 |
| splunk |
Process Execution via WMI |
production |
2026-05-13 |
| splunk |
Process Deleting Its Process File Path |
production |
2026-05-13 |
| splunk |
Process Creating LNK file in Suspicious Location |
production |
2026-05-13 |
| splunk |
Print Spooler Failed to Load a Plug-in |
production |
2026-05-13 |
| splunk |
Print Spooler Adding A Printer Driver |
production |
2026-05-13 |
| splunk |
Print Processor Registry Autostart |
production |
2026-05-13 |
| splunk |
Prevent Automatic Repair Mode using Bcdedit |
production |
2026-05-13 |
| splunk |
PowerShell WebRequest Using Memory Stream |
production |
2026-05-13 |
| splunk |
PowerShell Start or Stop Service |
production |
2026-05-13 |
| splunk |
PowerShell Start-BitsTransfer |
production |
2026-05-13 |
| splunk |
PowerShell Script Block With URL Chain |
production |
2026-05-13 |
| splunk |
Powershell Remote Services Add TrustedHost |
production |
2026-05-13 |
| splunk |
MOVEit Empty Key Fingerprint Authentication Attempt |
production |
2026-05-13 |
| splunk |
MOVEit Certificate Store Access Failure |
production |
2026-05-13 |
| splunk |
Monitor Registry Keys for Print Monitors |
production |
2026-05-13 |
| splunk |
Modify ACL permission To Files Or Folder |
production |
2026-05-13 |
| splunk |
Modification Of Wallpaper |
production |
2026-05-13 |
| splunk |
Mmc LOLBAS Execution Process Spawn |
production |
2026-05-13 |
| splunk |
Shai-Hulud 2 Exfiltration Artifact Files |
production |
2026-05-13 |
| splunk |
Mimikatz PassTheTicket CommandLine Parameters |
production |
2026-05-13 |
| splunk |
Microsoft Defender Incident Alerts |
production |
2026-05-13 |
| splunk |
Microsoft Defender ATP Alerts |
production |
2026-05-13 |
| splunk |
Malicious PowerShell Process With Obfuscation Techniques |
production |
2026-05-13 |
| splunk |
Malicious PowerShell Process - Encoded Command |
production |
2026-05-13 |