| splunk |
Rundll32 DNSQuery |
production |
2026-05-13 |
| splunk |
SMB Traffic Spike |
experimental |
2026-05-13 |
| splunk |
SSL Certificates with Punycode |
experimental |
2026-05-13 |
| splunk |
Suspicious Process DNS Query Known Abuse Web Services |
production |
2026-05-13 |
| splunk |
TOR Traffic |
production |
2026-05-13 |
| splunk |
HTTP Request to Reserved Name on IIS Server |
production |
2026-05-13 |
| splunk |
Wermgr Process Connecting To IP Check Web Services |
production |
2026-05-13 |
| splunk |
Windows Abused Web Services |
production |
2026-05-13 |
| splunk |
Windows AD Replication Service Traffic |
experimental |
2026-05-13 |
| splunk |
Windows AD Rogue Domain Controller Network Activity |
experimental |
2026-05-13 |
| splunk |
Windows Multi hop Proxy TOR Website Query |
production |
2026-05-13 |
| splunk |
Windows Remote Desktop Network Bruteforce Attempt |
production |
2026-05-13 |
| splunk |
Windows Spearphishing Attachment Connect To None MS Office Domain |
production |
2026-05-13 |
| splunk |
Zeek x509 Certificate with Punycode |
experimental |
2026-05-13 |
| splunk |
Access to Vulnerable Ivanti Connect Secure Bookmark Endpoint |
production |
2026-05-13 |
| splunk |
Adobe ColdFusion Access Control Bypass |
production |
2026-05-13 |
| splunk |
Adobe ColdFusion Unauthenticated Arbitrary File Read |
production |
2026-05-13 |
| splunk |
Cisco IOS XE Implant Access |
production |
2026-05-13 |
| splunk |
Citrix ADC and Gateway CitrixBleed 2 Memory Disclosure |
production |
2026-05-13 |
| splunk |
Citrix ADC and Gateway Unauthorized Data Disclosure |
production |
2026-05-13 |
| splunk |
Citrix ShareFile Exploitation CVE-2023-24489 |
production |
2026-05-13 |
| splunk |
F5 TMUI Authentication Bypass |
production |
2026-05-13 |
| splunk |
Windows IOBit Unlocker Extension DLL Registration via Regsvr32 |
production |
2026-05-13 |
| splunk |
Windows ISO LNK File Creation |
production |
2026-05-13 |
| splunk |
Windows Kerberos Coercion via DNS |
production |
2026-05-13 |
| splunk |
Windows Known GraphicalProton Loaded Modules |
production |
2026-05-13 |
| splunk |
Windows KrbRelayUp Service Creation |
production |
2026-05-13 |
| splunk |
Windows LAPS Password Gathering Via PowerShell Script |
production |
2026-05-13 |
| splunk |
Windows Ldifde Directory Object Behavior |
production |
2026-05-13 |
| splunk |
Windows Level RMM PowerShell Script Installer |
production |
2026-05-13 |
| splunk |
Windows Level RMM Watchdog Task Created |
production |
2026-05-13 |
| splunk |
Windows Linked Policies In ADSI Discovery |
production |
2026-05-13 |
| splunk |
Windows List ENV Variables Via SET Command From Uncommon Parent |
production |
2026-05-13 |
| splunk |
Windows Local Administrator Credential Stuffing |
production |
2026-05-13 |
| splunk |
Windows LSA Secrets NoLMhash Registry |
production |
2026-05-13 |
| splunk |
Windows Mail Protocol In Non-Common Process Path |
production |
2026-05-13 |
| splunk |
Windows Masquerading Explorer As Child Process |
production |
2026-05-13 |
| splunk |
Windows Masquerading Msdtc Process |
production |
2026-05-13 |
| splunk |
Windows Metasploit Confluence Plugin Execution |
production |
2026-05-13 |
| splunk |
Windows Mimikatz Binary Execution |
production |
2026-05-13 |