| splunk |
Windows Registry Modification for Safe Mode Persistence |
production |
2026-05-13 |
| splunk |
Windows Registry Payload Injection |
production |
2026-05-13 |
| splunk |
Windows Registry SIP Provider Modification |
production |
2026-05-13 |
| splunk |
Windows Remote Assistance Spawning Process |
production |
2026-05-13 |
| splunk |
Windows Remote Create Service |
production |
2026-05-13 |
| splunk |
Windows Remote Host Computer Management Access |
production |
2026-05-13 |
| splunk |
Windows Remote Image Load |
production |
2026-05-13 |
| splunk |
Windows Remote Management Execute Shell |
production |
2026-05-13 |
| splunk |
Windows Remote Service Rdpwinst Tool Execution |
production |
2026-05-13 |
| splunk |
Anomalous usage of 7zip |
production |
2026-05-13 |
| splunk |
Windows Remote Services Allow Rdp In Firewall |
production |
2026-05-13 |
| splunk |
Windows Remote Services Allow Remote Assistance |
production |
2026-05-13 |
| splunk |
Windows Remote Services Rdp Enable |
production |
2026-05-13 |
| splunk |
Windows Replication Through Removable Media |
production |
2026-05-13 |
| splunk |
Auto Admin Logon Registry Entry |
production |
2026-05-13 |
| splunk |
Windows Root Domain linked policies Discovery |
production |
2026-05-13 |
| splunk |
Windows Routing and Remote Access Service Registry Key Change |
production |
2026-05-13 |
| splunk |
Windows Rundll32 Apply User Settings Changes |
production |
2026-05-13 |
| splunk |
Windows Rundll32 Execution With Log.DLL |
production |
2026-05-13 |
| splunk |
Windows Rundll32 Load DLL in Temp Dir |
production |
2026-05-13 |
| splunk |
Windows Rundll32 WebDAV Request |
production |
2026-05-13 |
| splunk |
Windows Rundll32 WebDav With Network Connection |
production |
2026-05-13 |
| splunk |
Windows Rundll32 with Non-Standard File Extension |
production |
2026-05-13 |
| splunk |
Windows RunMRU Command Execution |
production |
2026-05-13 |
| splunk |
Windows RunMRU Registry Key or Value Deleted |
production |
2026-05-13 |
| splunk |
Windows Scheduled Task Created in a Group Policy Object |
production |
2026-05-13 |
| splunk |
Windows Scheduled Task Created Via XML |
production |
2026-05-13 |
| splunk |
Windows Scheduled Task DLL Module Loaded |
production |
2026-05-13 |
| splunk |
Windows Scheduled Task with Highest Privileges |
production |
2026-05-13 |
| splunk |
Windows Scheduled Tasks for CompMgmtLauncher or Eventvwr |
production |
2026-05-13 |
| splunk |
Windows Schtasks Create Run As System |
production |
2026-05-13 |
| splunk |
Windows ScManager Security Descriptor Tampering Via Sc.EXE |
production |
2026-05-13 |
| splunk |
Windows Screen Capture Via Powershell |
production |
2026-05-13 |
| splunk |
Windows Security Account Manager Stopped |
production |
2026-05-13 |
| splunk |
Windows Security And Backup Services Stop |
production |
2026-05-13 |
| splunk |
Windows Security Support Provider Reg Query |
production |
2026-05-13 |
| splunk |
Windows Sensitive Group Discovery With Net |
production |
2026-05-13 |
| splunk |
Windows Sensitive Registry Hive Dump Via CommandLine |
production |
2026-05-13 |
| splunk |
Windows Server Software Component GACUtil Install to GAC |
production |
2026-05-13 |
| splunk |
Windows Service Create Kernel Mode Driver |
production |
2026-05-13 |