| splunk |
Windows Account Discovery for None Disable User Account |
production |
2026-05-13 |
| splunk |
Windows Account Discovery for Sam Account Name |
production |
2026-05-13 |
| splunk |
Windows Account Discovery With NetUser PreauthNotRequire |
production |
2026-05-13 |
| splunk |
Windows AD Abnormal Object Access Activity |
production |
2026-05-13 |
| splunk |
Windows AD Cross Domain SID History Addition |
production |
2026-05-13 |
| splunk |
Windows AD Domain Controller Promotion |
production |
2026-05-13 |
| splunk |
Windows AD DSRM Account Changes |
production |
2026-05-13 |
| splunk |
Windows AD DSRM Password Reset |
production |
2026-05-13 |
| splunk |
Windows AD GPO Deleted |
production |
2026-05-13 |
| splunk |
Windows AD GPO Disabled |
production |
2026-05-13 |
| splunk |
Windows AD Privileged Object Access Activity |
production |
2026-05-13 |
| splunk |
Windows AD Replication Request Initiated by User Account |
production |
2026-05-13 |
| splunk |
Windows AD Replication Request Initiated from Unsanctioned Location |
production |
2026-05-13 |
| splunk |
Windows AD Same Domain SID History Addition |
production |
2026-05-13 |
| splunk |
Windows AD ServicePrincipalName Added To Domain Account |
production |
2026-05-13 |
| splunk |
Windows AD Short Lived Domain Account ServicePrincipalName |
production |
2026-05-13 |
| splunk |
Windows AD Short Lived Domain Controller SPN Attribute |
production |
2026-05-13 |
| splunk |
Windows AD Short Lived Server Object |
production |
2026-05-13 |
| splunk |
Windows AD SID History Attribute Modified |
production |
2026-05-13 |
| splunk |
Windows AD Suspicious Attribute Modification |
production |
2026-05-13 |
| splunk |
Windows AdFind Exe |
production |
2026-05-13 |
| splunk |
Windows Admin Permission Discovery |
production |
2026-05-13 |
| splunk |
Windows Administrative Shares Accessed On Multiple Hosts |
production |
2026-05-13 |
| splunk |
Windows Admon Default Group Policy Object Modified |
production |
2026-05-13 |
| splunk |
Windows Admon Group Policy Object Created |
production |
2026-05-13 |
| splunk |
Windows Advanced Installer MSIX with AI_STUBS Execution |
production |
2026-05-13 |
| splunk |
Windows Alternate DataStream - Base64 Content |
production |
2026-05-13 |
| splunk |
Windows Alternate DataStream - Executable Content |
production |
2026-05-13 |
| splunk |
Windows Anomalous Registry Value Length in Environment Key |
production |
2026-05-13 |
| splunk |
Windows Anonymous Pipe Activity |
production |
2026-05-13 |
| splunk |
Windows Apache Benchmark Binary |
production |
2026-05-13 |
| splunk |
Windows App Layer Protocol Qakbot NamedPipe |
production |
2026-05-13 |
| splunk |
Windows Application Layer Protocol RMS Radmin Tool Namedpipe |
production |
2026-05-13 |
| splunk |
Windows Application Whitelisting Bypass Attempt via Rundll32 |
production |
2026-05-13 |
| splunk |
Windows AppLocker Execution from Uncommon Locations |
production |
2026-05-13 |
| splunk |
Windows AppLocker Rare Application Launch Detection |
production |
2026-05-13 |
| splunk |
Windows AppX Deployment Full Trust Package Installation |
production |
2026-05-13 |
| splunk |
Windows AppX Deployment Package Installation Success |
production |
2026-05-13 |
| splunk |
Windows AppX Deployment Unsigned Package Installation |
production |
2026-05-13 |
| splunk |
Windows Archive Collected Data via Powershell |
production |
2026-05-13 |