| splunk |
Windows Exfiltration Over C2 Via Invoke RestMethod |
production |
2026-05-13 |
| splunk |
Windows Exfiltration Over C2 Via Powershell UploadString |
production |
2026-05-13 |
| splunk |
Windows Explorer.exe Spawning PowerShell or Cmd |
production |
2026-05-13 |
| splunk |
Windows Explorer LNK Exploit Process Launch With Padding |
production |
2026-05-13 |
| splunk |
Windows Export Certificate |
production |
2026-05-13 |
| splunk |
Windows File and Directory Enable ReadOnly Permissions |
production |
2026-05-13 |
| splunk |
Windows File and Directory Permissions Enable Inheritance |
production |
2026-05-13 |
| splunk |
Windows File and Directory Permissions Remove Inheritance |
production |
2026-05-13 |
| splunk |
Windows File Association Modification via Ftype |
production |
2026-05-13 |
| splunk |
Windows Findstr GPP Discovery |
production |
2026-05-13 |
| splunk |
Windows File Collection Via Copy Utilities |
production |
2026-05-13 |
| splunk |
Windows File Share Discovery With Powerview |
production |
2026-05-13 |
| splunk |
Windows Gdrive Binary Activity |
production |
2026-05-13 |
| splunk |
Windows Files and Dirs Access Rights Modification Via Icacls |
production |
2026-05-13 |
| splunk |
Windows Filtering Platform Policy Added to Block EDR Process |
production |
2026-05-13 |
| splunk |
Windows Find Domain Organizational Units with GetDomainOU |
production |
2026-05-13 |
| splunk |
Windows Find Interesting ACL with FindInterestingDomainAcl |
production |
2026-05-13 |
| splunk |
Windows Firewall Rule Deletion |
production |
2026-05-13 |
| splunk |
Windows Firewall Rule Modification |
production |
2026-05-13 |
| splunk |
Windows Forest Discovery with GetForestDomain |
production |
2026-05-13 |
| splunk |
Windows Gather Victim Host Information Camera |
production |
2026-05-13 |
| splunk |
Windows Gather Victim Identity SAM Info |
production |
2026-05-13 |
| splunk |
Windows Get-AdComputer Unconstrained Delegation Discovery |
production |
2026-05-13 |
| splunk |
Windows Get Local Admin with FindLocalAdminAccess |
production |
2026-05-13 |
| splunk |
Windows Get-Variable.EXE Execution from WindowsApps Folder |
production |
2026-05-13 |
| splunk |
Windows Global Object Access Audit List Cleared Via Auditpol |
production |
2026-05-13 |
| splunk |
Windows GrimResource - MMC Process Accessing APDS DLL |
production |
2026-05-13 |
| splunk |
Windows Group Discovery Via Net |
production |
2026-05-13 |
| splunk |
Windows Hidden Schedule Task Settings |
production |
2026-05-13 |
| splunk |
Windows Hide Notification Features Through Registry |
production |
2026-05-13 |
| splunk |
Windows High File Deletion Frequency |
production |
2026-05-13 |
| splunk |
Windows Hijack Execution Flow Version Dll Side Load |
production |
2026-05-13 |
| splunk |
Windows Hunting System Account Targeting Lsass |
production |
2026-05-13 |
| splunk |
Windows Identify PowerShell Web Access IIS Pool |
production |
2026-05-13 |
| splunk |
Windows IIS Components Add New Module |
production |
2026-05-13 |
| splunk |
Windows IIS Components Get-WebGlobalModule Module Query |
production |
2026-05-13 |
| splunk |
Windows IIS Components Module Failed to Load |
production |
2026-05-13 |
| splunk |
Windows IIS Components New Module Added |
production |
2026-05-13 |
| splunk |
Windows Impair Defense Add Xml Applocker Rules |
production |
2026-05-13 |
| splunk |
Windows Impair Defense Change Win Defender Health Check Intervals |
production |
2026-05-13 |