| elastic |
Network-Level Authentication (NLA) Disabled |
production |
2026-09-18 |
| elastic |
PowerShell Script Block Logging Disabled |
production |
2026-09-18 |
| elastic |
Disable Windows Firewall Rules via Netsh |
production |
2026-09-18 |
| elastic |
Disabling Windows Defender Security Settings via PowerShell |
production |
2026-09-18 |
| elastic |
Disable Windows Event and Security Logs Using Built-in Tools |
production |
2026-09-18 |
| elastic |
DNS-over-HTTPS Enabled via Registry |
production |
2026-09-18 |
| elastic |
Suspicious .NET Code Compilation |
production |
2026-09-18 |
| elastic |
Potential EDR-Freeze via WerFaultSecure Abuse |
production |
2026-09-18 |
| elastic |
Remote Desktop Enabled in Windows Firewall by Netsh |
production |
2026-09-18 |
| elastic |
Enable Host Network Discovery via Netsh |
production |
2026-09-18 |
| elastic |
Control Panel Process with Unusual Arguments |
production |
2026-09-18 |
| elastic |
ImageLoad via Windows Update Auto Update Client |
production |
2026-09-18 |
| elastic |
Microsoft Build Engine Started by an Office Application |
production |
2026-09-18 |
| elastic |
Microsoft Build Engine Started by a Script Process |
production |
2026-09-18 |
| elastic |
Microsoft Build Engine Started by a System Process |
production |
2026-09-18 |
| elastic |
Microsoft Build Engine Using an Alternate Name |
production |
2026-09-18 |
| elastic |
Microsoft Build Engine Started an Unusual Process |
production |
2026-09-18 |
| elastic |
Potential DLL Side-Loading via Trusted Microsoft Programs |
production |
2026-09-18 |
| elastic |
Suspicious Microsoft Antimalware Service Execution |
production |
2026-09-18 |
| elastic |
Executable File Creation with Multiple Extensions |
production |
2026-09-18 |
| elastic |
Process Execution from an Unusual Directory |
production |
2026-09-18 |
| elastic |
IIS HTTP Logging Disabled |
production |
2026-09-18 |
| elastic |
Proxy Execution via Console Window Host |
production |
2026-09-18 |
| elastic |
Command Execution via ForFiles |
production |
2026-09-18 |
| elastic |
Proxy Execution via Windows OpenSSH |
production |
2026-09-18 |
| elastic |
Process Injection by the Microsoft Build Engine |
production |
2026-09-18 |
| elastic |
InstallUtil Process Making Network Connections |
production |
2026-09-18 |
| elastic |
Execution via Windows Command Debugging Utility |
production |
2026-09-18 |
| elastic |
Disabling Lsa Protection via Registry Modification |
production |
2026-09-18 |
| elastic |
Suspicious Endpoint Security Parent Process |
production |
2026-09-18 |
| elastic |
Potential Masquerading as Svchost |
production |
2026-09-18 |
| elastic |
Potential Masquerading as Business App Installer |
production |
2026-09-18 |
| elastic |
Potential Masquerading as Communication Apps |
production |
2026-09-18 |
| elastic |
Renamed Automation Script Interpreter |
production |
2026-09-18 |
| elastic |
Suspicious WerFault Child Process |
production |
2026-09-18 |
| elastic |
Program Files Directory Masquerading |
production |
2026-09-18 |
| elastic |
Potential Windows Error Manager Masquerading |
production |
2026-09-18 |
| elastic |
Potential Masquerading as System32 DLL |
production |
2026-09-18 |
| elastic |
Microsoft Windows Defender Tampering |
production |
2026-09-18 |
| elastic |
Network Connection via Signed Binary |
production |
2026-09-18 |