| splunk |
Windows Remote Host Computer Management Access |
production |
2026-05-13 |
| splunk |
Windows Remote Image Load |
production |
2026-05-13 |
| splunk |
Windows Remote Management Execute Shell |
production |
2026-05-13 |
| splunk |
Windows Remote Service Rdpwinst Tool Execution |
production |
2026-05-13 |
| splunk |
Windows Remote Services Allow Rdp In Firewall |
production |
2026-05-13 |
| splunk |
Windows Remote Services Allow Remote Assistance |
production |
2026-05-13 |
| splunk |
Windows Remote Services Rdp Enable |
production |
2026-05-13 |
| splunk |
Windows Replication Through Removable Media |
production |
2026-05-13 |
| splunk |
Windows Root Domain linked policies Discovery |
production |
2026-05-13 |
| splunk |
Windows Routing and Remote Access Service Registry Key Change |
production |
2026-05-13 |
| splunk |
Windows Rundll32 Apply User Settings Changes |
production |
2026-05-13 |
| splunk |
Windows Rundll32 Execution With Log.DLL |
production |
2026-05-13 |
| splunk |
Windows Rundll32 Load DLL in Temp Dir |
production |
2026-05-13 |
| splunk |
Windows Rundll32 WebDAV Request |
production |
2026-05-13 |
| splunk |
Windows Rundll32 WebDav With Network Connection |
production |
2026-05-13 |
| splunk |
Windows Rundll32 with Non-Standard File Extension |
production |
2026-05-13 |
| splunk |
Windows RunMRU Command Execution |
production |
2026-05-13 |
| splunk |
Windows RunMRU Registry Key or Value Deleted |
production |
2026-05-13 |
| splunk |
Windows Scheduled Task Created in a Group Policy Object |
production |
2026-05-13 |
| splunk |
Windows Scheduled Task Created Via XML |
production |
2026-05-13 |
| splunk |
Windows Scheduled Task DLL Module Loaded |
production |
2026-05-13 |
| splunk |
Suspicious mshta child process |
production |
2026-05-13 |
| splunk |
Windows WMI Process And Service List |
production |
2026-05-13 |
| splunk |
Windows WMI Process Call Create |
production |
2026-05-13 |
| splunk |
Windows WMI Reconnaissance Class Query |
production |
2026-05-13 |
| splunk |
Windows Wmic CPU Discovery |
production |
2026-05-13 |
| splunk |
Windows Wmic DiskDrive Discovery |
production |
2026-05-13 |
| splunk |
Windows Wmic Memory Chip Discovery |
production |
2026-05-13 |
| splunk |
Windows Wmic Network Discovery |
production |
2026-05-13 |
| splunk |
Windows WMIC Shadowcopy Delete |
production |
2026-05-13 |
| splunk |
Windows Wmic Systeminfo Discovery |
production |
2026-05-13 |
| splunk |
Windows WPDBusEnum Registry Key Modification |
production |
2026-05-13 |
| splunk |
Windows WSUS Spawning Shell |
production |
2026-05-13 |
| splunk |
Windows XLL File Creation Outside of Typical Location |
production |
2026-05-13 |
| splunk |
WinEvent Scheduled Task Created to Spawn Shell |
production |
2026-05-13 |
| splunk |
WinEvent Scheduled Task Created Within Public Path |
production |
2026-05-13 |
| splunk |
WinEvent Windows Task Scheduler Event Action Started |
production |
2026-05-13 |
| splunk |
Winhlp32 Spawning a Process |
production |
2026-05-13 |
| splunk |
WinRAR Spawning Shell Application |
production |
2026-05-13 |
| splunk |
WinRM Spawning a Process |
experimental |
2026-05-13 |