| splunk |
Linux Suspicious React or Next.js Child Process |
production |
2026-05-13 |
| splunk |
Linux System Network Discovery |
production |
2026-05-13 |
| splunk |
Linux System Reboot Via System Request Key |
production |
2026-05-13 |
| splunk |
Linux Telnet Authentication Bypass |
production |
2026-05-13 |
| splunk |
Linux Unix Shell Enable All SysRq Functions |
production |
2026-05-13 |
| splunk |
Linux Visudo Utility Execution |
production |
2026-05-13 |
| splunk |
Living Off The Land Detection |
production |
2026-05-13 |
| splunk |
Loading Of Dynwrapx Module |
production |
2026-05-13 |
| splunk |
Local Account Discovery With Wmic |
production |
2026-05-13 |
| splunk |
Log4Shell CVE-2021-44228 Exploitation |
production |
2026-05-13 |
| splunk |
Logon Script Event Trigger Execution |
production |
2026-05-13 |
| splunk |
Ntdsutil Export NTDS |
production |
2026-05-13 |
| splunk |
Outbound Network Connection from Java Using Default Ports |
production |
2026-05-13 |
| splunk |
Overwriting Accessibility Binaries |
production |
2026-05-13 |
| splunk |
PaperCut NG Suspicious Behavior Debug Log |
production |
2026-05-13 |
| splunk |
Permission Modification using Takeown App |
production |
2026-05-13 |
| splunk |
PetitPotam Network Share Access Request |
production |
2026-05-13 |
| splunk |
Detect Use of cmd exe to Launch Script Interpreters |
production |
2026-05-13 |
| splunk |
Possible Browser Pass View Parameter |
production |
2026-05-13 |
| splunk |
Potential System Network Configuration Discovery Activity |
production |
2026-05-13 |
| splunk |
Potential Telegram API Request Via CommandLine |
production |
2026-05-13 |
| splunk |
Powershell COM Hijacking InprocServer32 Modification |
production |
2026-05-13 |
| splunk |
Powershell Creating Thread Mutex |
production |
2026-05-13 |
| splunk |
PowerShell Enable PowerShell Remoting |
production |
2026-05-13 |
| splunk |
Powershell Enable SMB1Protocol Feature |
production |
2026-05-13 |
| splunk |
Powershell Execute COM Object |
production |
2026-05-13 |
| splunk |
Powershell Fileless Process Injection via GetProcAddress |
production |
2026-05-13 |
| splunk |
PowerShell Get LocalGroup Discovery |
production |
2026-05-13 |
| splunk |
Powershell Get LocalGroup Discovery with Script Block Logging |
production |
2026-05-13 |
| splunk |
PowerShell Invoke CIMMethod CIMSession |
production |
2026-05-13 |
| splunk |
PowerShell Invoke WmiExec Usage |
production |
2026-05-13 |
| splunk |
Powershell Load Module in Meterpreter |
production |
2026-05-13 |
| splunk |
Detection of tools built by NirSoft |
experimental |
2026-05-13 |
| splunk |
Detect RTLO In File Name |
production |
2026-05-13 |
| splunk |
Ryuk Test Files Detected |
production |
2026-05-13 |
| splunk |
Ryuk Wake on LAN Command |
production |
2026-05-13 |
| splunk |
SAM Database File Access Attempt |
production |
2026-05-13 |
| splunk |
Samsam Test File Write |
production |
2026-05-13 |
| splunk |
SchCache Change By App Connect And Create ADSI Object |
production |
2026-05-13 |
| splunk |
Schedule Task with HTTP Command Arguments |
production |
2026-05-13 |