| splunk |
User Discovery With Env Vars PowerShell |
production |
2026-05-13 |
| splunk |
Schedule Task with Rundll32 Command Trigger |
production |
2026-05-13 |
| splunk |
Scheduled Task Creation on Remote Endpoint using At |
production |
2026-05-13 |
| splunk |
Scheduled Task Deleted Or Created via CMD |
production |
2026-05-13 |
| splunk |
Scheduled Task Initiation on Remote Endpoint |
production |
2026-05-13 |
| splunk |
Schtasks Run Task On Demand |
production |
2026-05-13 |
| splunk |
Schtasks scheduling job on remote system |
production |
2026-05-13 |
| splunk |
Schtasks used for forcing a reboot |
production |
2026-05-13 |
| splunk |
Screensaver Event Trigger Execution |
production |
2026-05-13 |
| splunk |
Script Execution via WMI |
production |
2026-05-13 |
| splunk |
Sdclt UAC Bypass |
production |
2026-05-13 |
| splunk |
Sdelete Application Execution |
production |
2026-05-13 |
| splunk |
SearchProtocolHost with no Command Line with Network |
production |
2026-05-13 |
| splunk |
Unusually Long Command Line |
experimental |
2026-05-13 |
| splunk |
SecretDumps Offline NTDS Dumping Tool |
production |
2026-05-13 |
| splunk |
ServicePrincipalNames Discovery with PowerShell |
production |
2026-05-13 |
| splunk |
ServicePrincipalNames Discovery with SetSPN |
production |
2026-05-13 |
| splunk |
Services Escalate Exe |
production |
2026-05-13 |
| splunk |
Services LOLBAS Execution Process Spawn |
production |
2026-05-13 |
| splunk |
Shai-Hulud Workflow File Creation or Modification |
production |
2026-05-13 |
| splunk |
Shim Database File Creation |
production |
2026-05-13 |
| splunk |
Shim Database Installation With Suspicious Parameters |
production |
2026-05-13 |
| splunk |
Short Lived Windows Accounts |
production |
2026-05-13 |
| splunk |
SilentCleanup UAC Bypass |
production |
2026-05-13 |
| splunk |
Unusual Number of Remote Endpoint Authentication Events |
experimental |
2026-05-13 |
| splunk |
System Information Discovery Detection |
production |
2026-05-13 |
| splunk |
System User Discovery With Query |
production |
2026-05-13 |
| splunk |
Trickbot Named Pipe |
production |
2026-05-13 |
| splunk |
UAC Bypass MMC Load Unsigned Dll |
production |
2026-05-13 |
| splunk |
UAC Bypass With Colorui COM Object |
production |
2026-05-13 |
| splunk |
Uninstall App Using MsiExec |
production |
2026-05-13 |
| splunk |
Unknown Process Using The Kerberos Protocol |
production |
2026-05-13 |
| splunk |
Unload Sysmon Filter Driver |
production |
2026-05-13 |
| splunk |
Unloading AMSI via Reflection |
production |
2026-05-13 |
| splunk |
Unusual Number of Computer Service Tickets Requested |
experimental |
2026-05-13 |
| splunk |
Disabled Kerberos Pre-Authentication Discovery With Get-ADUser |
production |
2026-05-13 |
| splunk |
Disabled Kerberos Pre-Authentication Discovery With PowerView |
production |
2026-05-13 |
| splunk |
Disabling CMD Application |
production |
2026-05-13 |
| splunk |
Disabling ControlPanel |
production |
2026-05-13 |
| splunk |
Disabling Defender Services |
production |
2026-05-13 |