| splunk |
Windows Universal Data Link File Creation |
production |
2026-05-13 |
| splunk |
Windows Unsigned DLL Side-Loading |
production |
2026-05-13 |
| splunk |
Windows Unsigned DLL Side-Loading In Same Process Path |
production |
2026-05-13 |
| splunk |
Windows Unsigned MS DLL Side-Loading |
production |
2026-05-13 |
| splunk |
Windows Unusual Count Of Disabled Users Failed Auth Using Kerberos |
production |
2026-05-13 |
| splunk |
Windows Unusual Count Of Invalid Users Fail To Auth Using Kerberos |
production |
2026-05-13 |
| splunk |
Windows Unusual Count Of Invalid Users Failed To Auth Using NTLM |
production |
2026-05-13 |
| splunk |
Windows Unusual Count Of Users Fail To Auth Wth ExplicitCredentials |
production |
2026-05-13 |
| splunk |
Windows Unusual Count Of Users Failed To Auth Using Kerberos |
production |
2026-05-13 |
| splunk |
Windows Unusual Count Of Users Failed To Authenticate From Process |
production |
2026-05-13 |
| splunk |
Windows Unusual Count Of Users Failed To Authenticate Using NTLM |
production |
2026-05-13 |
| splunk |
Windows Unusual Count Of Users Remotely Failed To Auth From Host |
production |
2026-05-13 |
| splunk |
Windows Unusual NTLM Authentication Destinations By Source |
production |
2026-05-13 |
| splunk |
Windows Unusual NTLM Authentication Destinations By User |
production |
2026-05-13 |
| splunk |
Windows Unusual NTLM Authentication Users By Destination |
production |
2026-05-13 |
| splunk |
Windows Unusual NTLM Authentication Users By Source |
production |
2026-05-13 |
| splunk |
Windows USBSTOR Registry Key Modification |
production |
2026-05-13 |
| splunk |
Windows User Deletion Via Net |
production |
2026-05-13 |
| splunk |
Windows User Disabled Via Net |
production |
2026-05-13 |
| splunk |
Windows User Execution Malicious URL Shortcut File |
production |
2026-05-13 |
| splunk |
Windows Visual Basic Commandline Compiler DNSQuery |
production |
2026-05-13 |
| splunk |
Windows Vulnerable 3CX Software |
production |
2026-05-13 |
| splunk |
Windows WBAdmin File Recovery From Backup |
production |
2026-05-13 |
| splunk |
Windows WinDBG Spawning AutoIt3 |
production |
2026-05-13 |
| splunk |
Windows WinLogon with Public Network Connection |
production |
2026-05-13 |
| splunk |
Windows WinPEAS PowerShell Script Execution |
production |
2026-05-13 |
| splunk |
Windows WinRAR Launched Outside Default Installation Directory |
production |
2026-05-13 |
| splunk |
Detect Windows DNS SIGRed via Zeek |
experimental |
2026-05-13 |
| splunk |
Detect Zerologon via Zeek |
experimental |
2026-05-13 |
| splunk |
DNS Query Length With High Standard Deviation |
production |
2026-05-13 |
| splunk |
Excessive DNS Failures |
experimental |
2026-05-13 |
| splunk |
F5 BIG-IP iControl REST Vulnerability CVE-2022-1388 |
production |
2026-05-13 |
| splunk |
HTTP Rapid POST with Mixed Status Codes |
production |
2026-05-13 |
| splunk |
Hosts receiving high volume of network traffic from email server |
experimental |
2026-05-13 |
| splunk |
Internal Horizontal Port Scan |
production |
2026-05-13 |
| splunk |
Internal Vertical Port Scan |
production |
2026-05-13 |
| splunk |
Large Volume of DNS ANY Queries |
experimental |
2026-05-13 |
| splunk |
Ngrok Reverse Proxy on Network |
production |
2026-05-13 |
| splunk |
Protocol or Port Mismatch |
production |
2026-05-13 |
| splunk |
Protocols passing authentication in cleartext |
production |
2026-05-13 |