| splunk |
Windows Modify Registry on Smart Card Group Policy |
production |
2026-05-13 |
| splunk |
Windows Modify Registry ValleyRat PWN Reg Entry |
production |
2026-05-13 |
| splunk |
Windows Modify Registry With MD5 Reg Key Name |
production |
2026-05-13 |
| splunk |
Windows Modify Registry WuServer |
production |
2026-05-13 |
| splunk |
Windows Modify Registry wuStatusServer |
production |
2026-05-13 |
| splunk |
Windows Modify Show Compress Color And Info Tip Registry |
production |
2026-05-13 |
| splunk |
Windows Modify System Firewall with Notable Process Path |
production |
2026-05-13 |
| splunk |
Windows MOF Event Triggered Execution via WMI |
production |
2026-05-13 |
| splunk |
Windows MOVEit Transfer Writing ASPX |
production |
2026-05-13 |
| splunk |
Windows MpCmdRun RemoveDefinitions Execution |
production |
2026-05-13 |
| splunk |
Windows MSC EvilTwin Directory Path Manipulation |
production |
2026-05-13 |
| splunk |
Windows MSExchange Management Mailbox Cmdlet Usage |
production |
2026-05-13 |
| splunk |
Windows Multiple Accounts Disabled |
production |
2026-05-13 |
| splunk |
Windows Multiple Disabled Users Failed To Authenticate Wth Kerberos |
production |
2026-05-13 |
| splunk |
Windows Multiple Invalid Users Fail To Authenticate Using Kerberos |
production |
2026-05-13 |
| splunk |
Windows Multiple Invalid Users Failed To Authenticate Using NTLM |
production |
2026-05-13 |
| splunk |
Windows Multiple NTLM Null Domain Authentications |
production |
2026-05-13 |
| splunk |
Windows Multiple Users Fail To Authenticate Wth ExplicitCredentials |
production |
2026-05-13 |
| splunk |
Windows Multiple Users Failed To Authenticate From Host Using NTLM |
production |
2026-05-13 |
| splunk |
Windows Multiple Users Failed To Authenticate From Process |
production |
2026-05-13 |
| splunk |
Windows Multiple Users Failed To Authenticate Using Kerberos |
production |
2026-05-13 |
| splunk |
Windows Multiple Users Remotely Failed To Authenticate From Host |
production |
2026-05-13 |
| splunk |
Windows Mustang Panda USB Tool Execution |
production |
2026-05-13 |
| splunk |
Windows Net System Service Discovery |
production |
2026-05-13 |
| splunk |
Windows NirSoft AdvancedRun |
production |
2026-05-13 |
| splunk |
Windows NirSoft Tool Bundle File Created |
production |
2026-05-13 |
| splunk |
Windows Njrat Fileless Storage via Registry |
production |
2026-05-13 |
| splunk |
Windows Non-System Account Targeting Lsass |
production |
2026-05-13 |
| splunk |
Windows Odbcconf Hunting |
production |
2026-05-13 |
| splunk |
Windows Odbcconf Load DLL |
production |
2026-05-13 |
| splunk |
Windows Odbcconf Load Response File |
production |
2026-05-13 |
| splunk |
Windows Office Product Dropped Cab or Inf File |
production |
2026-05-13 |
| splunk |
Windows Office Product Dropped Uncommon File |
production |
2026-05-13 |
| splunk |
Windows Outlook Macro Security Modified |
production |
2026-05-13 |
| splunk |
Windows Outlook WebView Registry Modification |
production |
2026-05-13 |
| sigma |
Cmd.EXE Missing Space Characters Execution Anomaly |
test |
2026-05-13 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.sanibelislandfloridarealestate .com domain |
rev 1 |
2026-05-12 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.sanibelislandfloridarealestate .com domain |
rev 1 |
2026-05-12 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.sanibelislandfloridarealestate .com domain |
rev 1 |
2026-05-12 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.sanibelislandfloridarealestate .com domain |
rev 1 |
2026-05-12 |