| splunk |
Wermgr Process Create Executable File |
production |
2026-05-13 |
| splunk |
Wermgr Process Spawned CMD Or Powershell Process |
production |
2026-05-13 |
| splunk |
Windows .Key File Creation in Root Directory |
production |
2026-05-13 |
| splunk |
Windows Account Access Removal via Logoff Exec |
production |
2026-05-13 |
| splunk |
Windows Account Discovery for None Disable User Account |
production |
2026-05-13 |
| splunk |
Windows Account Discovery for Sam Account Name |
production |
2026-05-13 |
| splunk |
Windows Account Discovery With NetUser PreauthNotRequire |
production |
2026-05-13 |
| splunk |
Windows AD Abnormal Object Access Activity |
production |
2026-05-13 |
| splunk |
Windows AD Cross Domain SID History Addition |
production |
2026-05-13 |
| splunk |
Windows AD Domain Controller Promotion |
production |
2026-05-13 |
| splunk |
Windows AD DSRM Account Changes |
production |
2026-05-13 |
| splunk |
Windows AD DSRM Password Reset |
production |
2026-05-13 |
| splunk |
Windows AD GPO Deleted |
production |
2026-05-13 |
| splunk |
Windows AD GPO Disabled |
production |
2026-05-13 |
| splunk |
Windows Audit Policy Disabled via Legacy Auditpol |
production |
2026-05-13 |
| splunk |
Windows Audit Policy Excluded Category via Auditpol |
production |
2026-05-13 |
| splunk |
Windows Audit Policy Restored via Auditpol |
production |
2026-05-13 |
| splunk |
Windows Audit Policy Security Descriptor Tampering via Auditpol |
production |
2026-05-13 |
| splunk |
Windows AutoIt3 Execution |
production |
2026-05-13 |
| splunk |
Windows Autostart Execution LSASS Driver Registry Modification |
production |
2026-05-13 |
| splunk |
Windows Azure PowerShell Module Installation Via PowerShell Script |
production |
2026-05-13 |
| splunk |
Windows Azure Storage Utility Execution Via CLI |
production |
2026-05-13 |
| splunk |
Windows Binary Execution from an Archive |
experimental |
2026-05-13 |
| splunk |
Windows Binary Proxy Execution Mavinject DLL Injection |
production |
2026-05-13 |
| splunk |
Windows BitDefender Submission Wizard DLL Sideloading |
experimental |
2026-05-13 |
| splunk |
Windows BitLocker Suspicious Command Usage |
production |
2026-05-13 |
| splunk |
Windows BitLockerToGo Process Execution |
production |
2026-05-13 |
| splunk |
Windows BitLockerToGo with Network Activity |
production |
2026-05-13 |
| splunk |
Windows Bluetooth Service Installed From Uncommon Location |
production |
2026-05-13 |
| splunk |
Windows BootLoader Inventory |
experimental |
2026-05-13 |
| splunk |
Windows Bypass UAC via Pkgmgr Tool |
production |
2026-05-13 |
| splunk |
Windows Cabinet File Extraction Via Expand |
production |
2026-05-13 |
| splunk |
Windows Cached Domain Credentials Reg Query |
production |
2026-05-13 |
| splunk |
Windows Certutil Root Certificate Addition |
production |
2026-05-13 |
| splunk |
Windows Change File Association Command To Notepad |
production |
2026-05-13 |
| splunk |
Windows Chrome Auto-Update Disabled via Registry |
production |
2026-05-13 |
| splunk |
Windows Chrome Enable Extension Loading via Command-Line |
production |
2026-05-13 |
| splunk |
Windows Chrome Extension Allowed Registry Modification |
production |
2026-05-13 |
| splunk |
Windows Chromium Browser Launched with Small Window Size |
production |
2026-05-13 |
| splunk |
Windows Chromium process Launched with Disable Popup Blocking |
production |
2026-05-13 |