| splunk |
Windows System User Privilege Discovery |
production |
2026-05-13 |
| splunk |
Windows TeamCity Payload Execution from Temp Directory |
production |
2026-05-13 |
| splunk |
Windows TeamCity Plugin Installed |
production |
2026-05-13 |
| splunk |
Cisco Secure Firewall - Communication Over Suspicious Ports |
production |
2026-05-13 |
| splunk |
Cisco Secure Firewall - Connection to File Sharing Domain |
production |
2026-05-13 |
| splunk |
Cisco Secure Firewall - High EVE Threat Confidence |
production |
2026-05-13 |
| splunk |
Cisco Secure Firewall - High Priority Intrusion Classification |
production |
2026-05-13 |
| splunk |
Internal Vulnerability Scan |
experimental |
2026-05-13 |
| splunk |
Cisco Secure Firewall - High Volume of Intrusion Events Per Host |
production |
2026-05-13 |
| splunk |
Cisco Secure Firewall - Lumma Stealer Activity |
production |
2026-05-13 |
| splunk |
Cisco Secure Firewall - Lumma Stealer Download Attempt |
production |
2026-05-13 |
| splunk |
Cisco Secure Firewall - Lumma Stealer Outbound Connection Attempt |
production |
2026-05-13 |
| splunk |
Cisco Secure Firewall - Oracle E-Business Suite Correlation |
production |
2026-05-13 |
| splunk |
Cisco Secure Firewall - Oracle E-Business Suite Exploitation |
production |
2026-05-13 |
| splunk |
Cisco Secure Firewall - Possibly Compromised Host |
experimental |
2026-05-13 |
| splunk |
Cisco Secure Firewall - Potential Data Exfiltration |
production |
2026-05-13 |
| splunk |
Cisco Secure Firewall - Privileged Command Execution via HTTP |
production |
2026-05-13 |
| splunk |
Cisco Secure Firewall - Rare Snort Rule Triggered |
production |
2026-05-13 |
| splunk |
Cisco Secure Firewall - React Server Components RCE Attempt |
production |
2026-05-13 |
| splunk |
Cisco Secure Firewall - Snort Rule Triggered Across Multiple Hosts |
production |
2026-05-13 |
| splunk |
Cisco Secure Firewall - Repeated Blocked Connections |
production |
2026-05-13 |
| splunk |
Allow Network Discovery In Firewall |
production |
2026-05-13 |
| splunk |
Allow Operation with Consent Admin |
production |
2026-05-13 |
| splunk |
Anomalous usage of 7zip |
production |
2026-05-13 |
| splunk |
Auto Admin Logon Registry Entry |
production |
2026-05-13 |
| splunk |
Bcdedit Command Back To Normal Mode Boot |
production |
2026-05-13 |
| splunk |
BCDEdit Failure Recovery Modification |
production |
2026-05-13 |
| splunk |
BITS Job Persistence |
production |
2026-05-13 |
| splunk |
BITSAdmin Download File |
production |
2026-05-13 |
| splunk |
Certutil exe certificate extraction |
production |
2026-05-13 |
| splunk |
CertUtil With Decode Argument |
production |
2026-05-13 |
| splunk |
Change To Safe Mode With Network Config |
production |
2026-05-13 |
| splunk |
Check Elevated CMD using whoami |
production |
2026-05-13 |
| splunk |
Cisco Isovalent - Access To Cloud Metadata Service |
production |
2026-05-13 |
| splunk |
Cisco Isovalent - Cron Job Creation |
production |
2026-05-13 |
| splunk |
Cisco Isovalent - Curl Execution With Insecure Flags |
production |
2026-05-13 |
| splunk |
Cisco Isovalent - Kprobe Spike |
production |
2026-05-13 |
| splunk |
Cisco Isovalent - Late Process Execution |
production |
2026-05-13 |
| splunk |
Cisco Isovalent - Non Allowlisted Image Use |
production |
2026-05-13 |
| splunk |
Cisco Isovalent - Nsenter Usage in Kubernetes Pod |
production |
2026-05-13 |