| splunk |
Windows Azure Storage Utility Execution Via CLI |
production |
2026-05-13 |
| splunk |
Windows Binary Execution from an Archive |
experimental |
2026-05-13 |
| splunk |
Windows Binary Proxy Execution Mavinject DLL Injection |
production |
2026-05-13 |
| splunk |
Windows BitDefender Submission Wizard DLL Sideloading |
experimental |
2026-05-13 |
| splunk |
Windows BitLocker Suspicious Command Usage |
production |
2026-05-13 |
| splunk |
Windows BitLockerToGo Process Execution |
production |
2026-05-13 |
| splunk |
Windows BitLockerToGo with Network Activity |
production |
2026-05-13 |
| splunk |
Windows Bluetooth Service Installed From Uncommon Location |
production |
2026-05-13 |
| splunk |
Windows BootLoader Inventory |
experimental |
2026-05-13 |
| splunk |
Windows Bypass UAC via Pkgmgr Tool |
production |
2026-05-13 |
| splunk |
Windows Cabinet File Extraction Via Expand |
production |
2026-05-13 |
| splunk |
Windows Cached Domain Credentials Reg Query |
production |
2026-05-13 |
| splunk |
Windows Certutil Root Certificate Addition |
production |
2026-05-13 |
| splunk |
Windows Change File Association Command To Notepad |
production |
2026-05-13 |
| splunk |
Windows Chrome Auto-Update Disabled via Registry |
production |
2026-05-13 |
| splunk |
Windows Chrome Enable Extension Loading via Command-Line |
production |
2026-05-13 |
| splunk |
Windows Chrome Extension Allowed Registry Modification |
production |
2026-05-13 |
| splunk |
Windows Chromium Browser Launched with Small Window Size |
production |
2026-05-13 |
| splunk |
Windows Chromium process Launched with Disable Popup Blocking |
production |
2026-05-13 |
| splunk |
Windows Chromium Process Launched with Logging Disabled |
production |
2026-05-13 |
| splunk |
Windows Chromium Process Loaded Extension via Command-Line |
production |
2026-05-13 |
| splunk |
Windows Chromium Process with Disabled Extensions |
production |
2026-05-13 |
| splunk |
Windows Cisco Secure Endpoint Related Service Stopped |
production |
2026-05-13 |
| splunk |
Windows Cisco Secure Endpoint Stop Immunet Service Via Sfc |
production |
2026-05-13 |
| splunk |
Windows Cisco Secure Endpoint Unblock File Via Sfc |
production |
2026-05-13 |
| splunk |
Windows Cisco Secure Endpoint Uninstall Immunet Service Via Sfc |
production |
2026-05-13 |
| splunk |
Windows Cmdline Tool Execution From Non-Shell Process |
production |
2026-05-13 |
| splunk |
Windows Cobalt Strike PowerShell Loader |
production |
2026-05-13 |
| splunk |
Windows COM Hijacking InprocServer32 Modification |
production |
2026-05-13 |
| splunk |
Windows Command and Scripting Interpreter Hunting Path Traversal |
production |
2026-05-13 |
| splunk |
Windows Command and Scripting Interpreter Path Traversal Exec |
production |
2026-05-13 |
| splunk |
Windows Delete or Modify System Firewall |
production |
2026-05-13 |
| splunk |
Windows Deleted Registry By A Non Critical Process File Path |
production |
2026-05-13 |
| splunk |
Windows Detect Network Scanner Behavior |
production |
2026-05-13 |
| splunk |
Windows Developer-Signed MSIX Package Installation |
production |
2026-05-13 |
| splunk |
Windows Devtunnels Execution |
production |
2026-05-13 |
| splunk |
Windows Devtunnels Image Loaded |
production |
2026-05-13 |
| splunk |
Windows Disable Change Password Through Registry |
production |
2026-05-13 |
| splunk |
Windows Disable Internet Explorer Addons |
production |
2026-05-13 |
| splunk |
Windows Group Policy Object Created |
production |
2026-05-13 |