| splunk |
Malicious PowerShell Process With Obfuscation Techniques |
production |
2026-05-13 |
| splunk |
Microsoft Defender ATP Alerts |
production |
2026-05-13 |
| splunk |
Microsoft Defender Incident Alerts |
production |
2026-05-13 |
| splunk |
Mimikatz PassTheTicket CommandLine Parameters |
production |
2026-05-13 |
| splunk |
Shai-Hulud 2 Exfiltration Artifact Files |
production |
2026-05-13 |
| splunk |
Mmc LOLBAS Execution Process Spawn |
production |
2026-05-13 |
| splunk |
Modification Of Wallpaper |
production |
2026-05-13 |
| splunk |
Modify ACL permission To Files Or Folder |
production |
2026-05-13 |
| splunk |
Monitor Registry Keys for Print Monitors |
production |
2026-05-13 |
| splunk |
MOVEit Certificate Store Access Failure |
production |
2026-05-13 |
| splunk |
MOVEit Empty Key Fingerprint Authentication Attempt |
production |
2026-05-13 |
| splunk |
Remote System Discovery with Adsisearcher |
production |
2026-05-13 |
| splunk |
Remote System Discovery with Dsquery |
production |
2026-05-13 |
| splunk |
Remote System Discovery with Wmic |
production |
2026-05-13 |
| splunk |
Remote WMI Command Attempt |
production |
2026-05-13 |
| splunk |
Resize ShadowStorage volume |
production |
2026-05-13 |
| splunk |
Revil Common Exec Parameter |
production |
2026-05-13 |
| splunk |
Revil Registry Entry |
production |
2026-05-13 |
| splunk |
Rubeus Command Line Parameters |
production |
2026-05-13 |
| splunk |
Runas Execution in CommandLine |
production |
2026-05-13 |
| splunk |
Rundll32 Control RunDLL Hunt |
production |
2026-05-13 |
| splunk |
Rundll32 Control RunDLL World Writable Directory |
production |
2026-05-13 |
| splunk |
Rundll32 LockWorkStation |
production |
2026-05-13 |
| splunk |
Rundll32 Process Creating Exe Dll Files |
production |
2026-05-13 |
| splunk |
Rundll32 Shimcache Flush |
production |
2026-05-13 |
| splunk |
Rundll32 with no Command Line Arguments with Network |
production |
2026-05-13 |
| splunk |
RunDLL Loading DLL By Ordinal |
production |
2026-05-13 |
| splunk |
Ryuk Test Files Detected |
production |
2026-05-13 |
| splunk |
Ryuk Wake on LAN Command |
production |
2026-05-13 |
| splunk |
SAM Database File Access Attempt |
production |
2026-05-13 |
| splunk |
Samsam Test File Write |
production |
2026-05-13 |
| splunk |
SchCache Change By App Connect And Create ADSI Object |
production |
2026-05-13 |
| splunk |
Schedule Task with HTTP Command Arguments |
production |
2026-05-13 |
| splunk |
Schedule Task with Rundll32 Command Trigger |
production |
2026-05-13 |
| splunk |
Scheduled Task Creation on Remote Endpoint using At |
production |
2026-05-13 |
| splunk |
Scheduled Task Deleted Or Created via CMD |
production |
2026-05-13 |
| splunk |
Scheduled Task Initiation on Remote Endpoint |
production |
2026-05-13 |
| splunk |
Schtasks Run Task On Demand |
production |
2026-05-13 |
| splunk |
Schtasks scheduling job on remote system |
production |
2026-05-13 |
| splunk |
Schtasks used for forcing a reboot |
production |
2026-05-13 |