| splunk |
O365 Added Service Principal |
production |
2026-05-13 |
| splunk |
System User Discovery With Query |
production |
2026-05-13 |
| splunk |
Trickbot Named Pipe |
production |
2026-05-13 |
| splunk |
UAC Bypass MMC Load Unsigned Dll |
production |
2026-05-13 |
| splunk |
UAC Bypass With Colorui COM Object |
production |
2026-05-13 |
| splunk |
Uninstall App Using MsiExec |
production |
2026-05-13 |
| splunk |
Unknown Process Using The Kerberos Protocol |
production |
2026-05-13 |
| splunk |
Unload Sysmon Filter Driver |
production |
2026-05-13 |
| splunk |
Unloading AMSI via Reflection |
production |
2026-05-13 |
| splunk |
Unusual Number of Computer Service Tickets Requested |
experimental |
2026-05-13 |
| splunk |
Unusual Number of Kerberos Service Tickets Requested |
production |
2026-05-13 |
| splunk |
Unusual Number of Remote Endpoint Authentication Events |
experimental |
2026-05-13 |
| splunk |
Unusually Long Command Line |
experimental |
2026-05-13 |
| splunk |
User Discovery With Env Vars PowerShell |
production |
2026-05-13 |
| splunk |
User Discovery With Env Vars PowerShell Script Block |
production |
2026-05-13 |
| splunk |
USN Journal Deletion |
production |
2026-05-13 |
| splunk |
Verclsid CLSID Execution |
production |
2026-05-13 |
| splunk |
WBAdmin Delete System Backups |
production |
2026-05-13 |
| splunk |
Wbemprox COM Object Execution |
production |
2026-05-13 |
| splunk |
Web or Application Server Spawning a Shell |
production |
2026-05-13 |
| splunk |
Web Servers Executing Suspicious Processes |
experimental |
2026-05-13 |
| splunk |
Wermgr Process Create Executable File |
production |
2026-05-13 |
| splunk |
Wermgr Process Spawned CMD Or Powershell Process |
production |
2026-05-13 |
| splunk |
Windows .Key File Creation in Root Directory |
production |
2026-05-13 |
| splunk |
Windows Account Access Removal via Logoff Exec |
production |
2026-05-13 |
| splunk |
Windows Account Discovery for None Disable User Account |
production |
2026-05-13 |
| splunk |
Windows Account Discovery for Sam Account Name |
production |
2026-05-13 |
| splunk |
Windows Account Discovery With NetUser PreauthNotRequire |
production |
2026-05-13 |
| splunk |
Windows AD Abnormal Object Access Activity |
production |
2026-05-13 |
| splunk |
Windows AD Cross Domain SID History Addition |
production |
2026-05-13 |
| splunk |
Windows AD Domain Controller Promotion |
production |
2026-05-13 |
| splunk |
Windows AD DSRM Account Changes |
production |
2026-05-13 |
| splunk |
Windows AD DSRM Password Reset |
production |
2026-05-13 |
| splunk |
Windows AD GPO Deleted |
production |
2026-05-13 |
| splunk |
Windows AD GPO Disabled |
production |
2026-05-13 |
| splunk |
Windows Command Obfuscation with Environment Variable Substrings |
production |
2026-05-13 |
| splunk |
Windows Common Abused Cmd Shell Risk Behavior |
production |
2026-05-13 |
| splunk |
Windows Compatibility Telemetry Suspicious Child Process |
production |
2026-05-13 |
| splunk |
Windows Compatibility Telemetry Tampering Through Registry |
production |
2026-05-13 |
| splunk |
Windows Computer Account Changed to Domain Controller |
production |
2026-05-13 |