| splunk |
Windows Unsigned MS DLL Side-Loading |
production |
2026-05-13 |
| splunk |
Windows Unusual Count Of Disabled Users Failed Auth Using Kerberos |
production |
2026-05-13 |
| splunk |
Windows Unusual Count Of Invalid Users Fail To Auth Using Kerberos |
production |
2026-05-13 |
| splunk |
Windows Unusual Count Of Invalid Users Failed To Auth Using NTLM |
production |
2026-05-13 |
| splunk |
Windows Unusual Count Of Users Fail To Auth Wth ExplicitCredentials |
production |
2026-05-13 |
| splunk |
Windows Unusual Count Of Users Failed To Auth Using Kerberos |
production |
2026-05-13 |
| splunk |
Windows Unusual Count Of Users Failed To Authenticate From Process |
production |
2026-05-13 |
| splunk |
Windows Unusual Count Of Users Failed To Authenticate Using NTLM |
production |
2026-05-13 |
| splunk |
Windows Unusual Count Of Users Remotely Failed To Auth From Host |
production |
2026-05-13 |
| splunk |
Windows Unusual NTLM Authentication Destinations By Source |
production |
2026-05-13 |
| splunk |
Windows Unusual NTLM Authentication Destinations By User |
production |
2026-05-13 |
| splunk |
Windows Unusual NTLM Authentication Users By Destination |
production |
2026-05-13 |
| splunk |
Windows Unusual NTLM Authentication Users By Source |
production |
2026-05-13 |
| splunk |
Windows USBSTOR Registry Key Modification |
production |
2026-05-13 |
| splunk |
Windows User Deletion Via Net |
production |
2026-05-13 |
| splunk |
Windows User Disabled Via Net |
production |
2026-05-13 |
| splunk |
Windows User Execution Malicious URL Shortcut File |
production |
2026-05-13 |
| splunk |
Windows Visual Basic Commandline Compiler DNSQuery |
production |
2026-05-13 |
| splunk |
Windows Vulnerable 3CX Software |
production |
2026-05-13 |
| splunk |
Windows WBAdmin File Recovery From Backup |
production |
2026-05-13 |
| splunk |
Windows XLL File Creation Outside of Typical Location |
production |
2026-05-13 |
| splunk |
Services Escalate Exe |
production |
2026-05-13 |
| splunk |
Services LOLBAS Execution Process Spawn |
production |
2026-05-13 |
| splunk |
Shai-Hulud Workflow File Creation or Modification |
production |
2026-05-13 |
| splunk |
Shim Database File Creation |
production |
2026-05-13 |
| splunk |
Shim Database Installation With Suspicious Parameters |
production |
2026-05-13 |
| splunk |
Short Lived Windows Accounts |
production |
2026-05-13 |
| splunk |
SilentCleanup UAC Bypass |
production |
2026-05-13 |
| splunk |
Single Letter Process On Endpoint |
production |
2026-05-13 |
| splunk |
SLUI RunAs Elevated |
production |
2026-05-13 |
| splunk |
SLUI Spawning a Process |
production |
2026-05-13 |
| splunk |
Spike in File Writes |
experimental |
2026-05-13 |
| splunk |
Spoolsv Spawning Rundll32 |
production |
2026-05-13 |
| splunk |
Spoolsv Suspicious Loaded Modules |
production |
2026-05-13 |
| splunk |
Spoolsv Suspicious Process Access |
production |
2026-05-13 |
| splunk |
Spoolsv Writing a DLL |
production |
2026-05-13 |
| splunk |
Spoolsv Writing a DLL - Sysmon |
production |
2026-05-13 |
| splunk |
Sqlite Module In Temp Folder |
production |
2026-05-13 |
| splunk |
Steal or Forge Authentication Certificates Behavior Identified |
production |
2026-05-13 |
| splunk |
Sunburst Correlation DLL and Network Event |
experimental |
2026-05-13 |