| splunk |
Windows Service Deletion In Registry |
production |
2026-05-13 |
| splunk |
Windows Service Execution RemCom |
production |
2026-05-13 |
| splunk |
Windows Service Initiation on Remote Endpoint |
production |
2026-05-13 |
| splunk |
Windows Service Stop Attempt |
production |
2026-05-13 |
| splunk |
Windows Service Stop Win Updates |
production |
2026-05-13 |
| splunk |
Windows WinRAR Launched Outside Default Installation Directory |
production |
2026-05-13 |
| splunk |
Windows WinPEAS PowerShell Script Execution |
production |
2026-05-13 |
| splunk |
Windows WinLogon with Public Network Connection |
production |
2026-05-13 |
| splunk |
Windows WinDBG Spawning AutoIt3 |
production |
2026-05-13 |
| splunk |
Windows WBAdmin File Recovery From Backup |
production |
2026-05-13 |
| splunk |
Windows Vulnerable 3CX Software |
production |
2026-05-13 |
| splunk |
Windows Visual Basic Commandline Compiler DNSQuery |
production |
2026-05-13 |
| splunk |
Windows User Execution Malicious URL Shortcut File |
production |
2026-05-13 |
| splunk |
Windows User Disabled Via Net |
production |
2026-05-13 |
| splunk |
Windows User Deletion Via Net |
production |
2026-05-13 |
| splunk |
Windows USBSTOR Registry Key Modification |
production |
2026-05-13 |
| splunk |
Windows Unusual NTLM Authentication Users By Source |
production |
2026-05-13 |
| splunk |
Windows Unusual NTLM Authentication Users By Destination |
production |
2026-05-13 |
| splunk |
Windows Unusual NTLM Authentication Destinations By User |
production |
2026-05-13 |
| splunk |
Windows Unusual NTLM Authentication Destinations By Source |
production |
2026-05-13 |
| splunk |
Windows Unusual Count Of Users Remotely Failed To Auth From Host |
production |
2026-05-13 |
| splunk |
Windows Unusual Count Of Users Failed To Authenticate Using NTLM |
production |
2026-05-13 |
| splunk |
Windows Unusual Count Of Users Failed To Authenticate From Process |
production |
2026-05-13 |
| splunk |
Windows Unusual Count Of Users Failed To Auth Using Kerberos |
production |
2026-05-13 |
| splunk |
Windows Unusual Count Of Users Fail To Auth Wth ExplicitCredentials |
production |
2026-05-13 |
| splunk |
Windows Unusual Count Of Invalid Users Failed To Auth Using NTLM |
production |
2026-05-13 |
| splunk |
Windows Unusual Count Of Invalid Users Fail To Auth Using Kerberos |
production |
2026-05-13 |
| splunk |
Windows Unusual Count Of Disabled Users Failed Auth Using Kerberos |
production |
2026-05-13 |
| splunk |
Windows Unsigned MS DLL Side-Loading |
production |
2026-05-13 |
| splunk |
Windows Unsigned DLL Side-Loading In Same Process Path |
production |
2026-05-13 |
| splunk |
Windows Unsigned DLL Side-Loading |
production |
2026-05-13 |
| splunk |
Windows Universal Data Link File Creation |
production |
2026-05-13 |
| splunk |
Cisco Duo Admin Login Unusual Browser |
production |
2026-05-13 |
| splunk |
Cisco Duo Admin Login Unusual Country |
production |
2026-05-13 |
| splunk |
Cisco Duo Admin Login Unusual Os |
production |
2026-05-13 |
| splunk |
Cisco Duo Bulk Policy Deletion |
production |
2026-05-13 |
| splunk |
Cisco Duo Bypass Code Generation |
production |
2026-05-13 |
| splunk |
Cisco Duo Policy Allow Devices Without Screen Lock |
production |
2026-05-13 |
| splunk |
Cisco Duo Policy Allow Network Bypass 2FA |
production |
2026-05-13 |
| splunk |
Cisco Duo Policy Allow Old Flash |
production |
2026-05-13 |