| splunk |
Remote Process Instantiation via WMI and PowerShell Script Block |
production |
2026-05-13 |
| splunk |
Single Letter Process On Endpoint |
production |
2026-05-13 |
| splunk |
SLUI RunAs Elevated |
production |
2026-05-13 |
| splunk |
SLUI Spawning a Process |
production |
2026-05-13 |
| splunk |
Spike in File Writes |
experimental |
2026-05-13 |
| splunk |
Spoolsv Spawning Rundll32 |
production |
2026-05-13 |
| splunk |
Spoolsv Suspicious Loaded Modules |
production |
2026-05-13 |
| splunk |
Spoolsv Suspicious Process Access |
production |
2026-05-13 |
| splunk |
Spoolsv Writing a DLL |
production |
2026-05-13 |
| splunk |
Spoolsv Writing a DLL - Sysmon |
production |
2026-05-13 |
| splunk |
Sqlite Module In Temp Folder |
production |
2026-05-13 |
| splunk |
Steal or Forge Authentication Certificates Behavior Identified |
production |
2026-05-13 |
| splunk |
Sunburst Correlation DLL and Network Event |
experimental |
2026-05-13 |
| splunk |
Suspicious Computer Account Name Change |
production |
2026-05-13 |
| splunk |
Suspicious Copy on System32 |
production |
2026-05-13 |
| splunk |
Suspicious Curl Network Connection |
experimental |
2026-05-13 |
| splunk |
Suspicious DLLHost no Command Line Arguments |
production |
2026-05-13 |
| splunk |
Suspicious GPUpdate no Command Line Arguments |
production |
2026-05-13 |
| splunk |
Suspicious IcedID Rundll32 Cmdline |
production |
2026-05-13 |
| splunk |
Suspicious Image Creation In Appdata Folder |
production |
2026-05-13 |
| splunk |
Suspicious Kerberos Service Ticket Request |
production |
2026-05-13 |
| splunk |
Suspicious Linux Discovery Commands |
production |
2026-05-13 |
| splunk |
Suspicious microsoft workflow compiler usage |
production |
2026-05-13 |
| splunk |
Suspicious msbuild path |
production |
2026-05-13 |
| splunk |
Suspicious MSBuild Spawn |
production |
2026-05-13 |
| splunk |
Suspicious mshta child process |
production |
2026-05-13 |
| splunk |
Suspicious mshta spawn |
production |
2026-05-13 |
| splunk |
Suspicious PlistBuddy Usage |
experimental |
2026-05-13 |
| splunk |
Suspicious PlistBuddy Usage via OSquery |
experimental |
2026-05-13 |
| splunk |
Suspicious Reg exe Process |
production |
2026-05-13 |
| splunk |
Suspicious Regsvr32 Register Suspicious Path |
production |
2026-05-13 |
| splunk |
Suspicious Rundll32 dllregisterserver |
production |
2026-05-13 |
| splunk |
Suspicious Rundll32 no Command Line Arguments |
production |
2026-05-13 |
| splunk |
Suspicious Rundll32 PluginInit |
production |
2026-05-13 |
| splunk |
Suspicious Rundll32 StartW |
production |
2026-05-13 |
| splunk |
Suspicious Scheduled Task from Public Directory |
production |
2026-05-13 |
| splunk |
Suspicious SearchProtocolHost no Command Line Arguments |
production |
2026-05-13 |
| splunk |
Suspicious SQLite3 LSQuarantine Behavior |
experimental |
2026-05-13 |
| splunk |
Suspicious Ticket Granting Ticket Request |
production |
2026-05-13 |
| splunk |
Suspicious WAV file in Appdata Folder |
production |
2026-05-13 |