| splunk |
Windows RDP Connection Successful |
production |
2026-05-13 |
| splunk |
Windows RDP File Execution |
production |
2026-05-13 |
| splunk |
Windows RDP Login Session Was Established |
production |
2026-05-13 |
| splunk |
Windows RDP Server Registry Deletion |
production |
2026-05-13 |
| splunk |
Windows Remote Access Software BRC4 Loaded Dll |
production |
2026-05-13 |
| splunk |
Windows RDP Server Registry Entry Created |
production |
2026-05-13 |
| splunk |
Windows RDPClient Connection Sequence Events |
production |
2026-05-13 |
| splunk |
Windows Registry BootExecute Modification |
production |
2026-05-13 |
| splunk |
Windows Registry Certificate Added |
production |
2026-05-13 |
| splunk |
Windows Registry Delete Task SD |
production |
2026-05-13 |
| splunk |
Windows Remote Access Software RMS Registry |
production |
2026-05-13 |
| splunk |
Windows Registry Entries Exported Via Reg |
production |
2026-05-13 |
| splunk |
Windows Registry Entries Restored Via Reg |
production |
2026-05-13 |
| splunk |
Windows Registry Modification for Safe Mode Persistence |
production |
2026-05-13 |
| splunk |
Windows Registry Payload Injection |
production |
2026-05-13 |
| splunk |
Windows Registry SIP Provider Modification |
production |
2026-05-13 |
| splunk |
Windows Remote Assistance Spawning Process |
production |
2026-05-13 |
| splunk |
Windows Remote Create Service |
production |
2026-05-13 |
| splunk |
Windows Remote Host Computer Management Access |
production |
2026-05-13 |
| splunk |
Windows Remote Image Load |
production |
2026-05-13 |
| splunk |
Windows Remote Management Execute Shell |
production |
2026-05-13 |
| splunk |
Windows Remote Service Rdpwinst Tool Execution |
production |
2026-05-13 |
| splunk |
Windows Remote Services Allow Rdp In Firewall |
production |
2026-05-13 |
| splunk |
Windows Remote Services Allow Remote Assistance |
production |
2026-05-13 |
| splunk |
Windows Remote Services Rdp Enable |
production |
2026-05-13 |
| splunk |
Windows Replication Through Removable Media |
production |
2026-05-13 |
| splunk |
Windows Root Domain linked policies Discovery |
production |
2026-05-13 |
| splunk |
Windows Routing and Remote Access Service Registry Key Change |
production |
2026-05-13 |
| splunk |
Windows Rundll32 Apply User Settings Changes |
production |
2026-05-13 |
| splunk |
Windows Rundll32 Execution With Log.DLL |
production |
2026-05-13 |
| splunk |
Windows Rundll32 Load DLL in Temp Dir |
production |
2026-05-13 |
| splunk |
Windows Rundll32 WebDAV Request |
production |
2026-05-13 |
| splunk |
Windows Rundll32 WebDav With Network Connection |
production |
2026-05-13 |
| splunk |
Windows Rundll32 with Non-Standard File Extension |
production |
2026-05-13 |
| splunk |
Windows RunMRU Command Execution |
production |
2026-05-13 |
| splunk |
Windows RunMRU Registry Key or Value Deleted |
production |
2026-05-13 |
| splunk |
Windows Scheduled Task Created in a Group Policy Object |
production |
2026-05-13 |
| splunk |
Windows Scheduled Task Created Via XML |
production |
2026-05-13 |
| splunk |
Windows Scheduled Task DLL Module Loaded |
production |
2026-05-13 |
| splunk |
Windows Scheduled Task with Highest Privileges |
production |
2026-05-13 |