| splunk |
Windows Impair Defense Delete Win Defender Profile Registry |
production |
2026-05-13 |
| splunk |
Windows Impair Defense Delete Win Defender Context Menu |
production |
2026-05-13 |
| splunk |
Windows Impair Defense Define Win Defender Threat Action |
production |
2026-05-13 |
| splunk |
Windows Impair Defense Configure App Install Control |
production |
2026-05-13 |
| splunk |
Windows Impair Defense Change Win Defender Tracing Level |
production |
2026-05-13 |
| splunk |
Windows Impair Defense Change Win Defender Throttle Rate |
production |
2026-05-13 |
| splunk |
Windows Impair Defense Change Win Defender Quick Scan Interval |
production |
2026-05-13 |
| splunk |
Windows Impair Defense Change Win Defender Health Check Intervals |
production |
2026-05-13 |
| splunk |
Windows Impair Defense Add Xml Applocker Rules |
production |
2026-05-13 |
| splunk |
Windows IIS Components New Module Added |
production |
2026-05-13 |
| splunk |
Windows IIS Components Module Failed to Load |
production |
2026-05-13 |
| splunk |
Windows IIS Components Get-WebGlobalModule Module Query |
production |
2026-05-13 |
| splunk |
Windows IIS Components Add New Module |
production |
2026-05-13 |
| splunk |
Windows Identify PowerShell Web Access IIS Pool |
production |
2026-05-13 |
| splunk |
Windows Hunting System Account Targeting Lsass |
production |
2026-05-13 |
| splunk |
Windows Hijack Execution Flow Version Dll Side Load |
production |
2026-05-13 |
| splunk |
Windows High File Deletion Frequency |
production |
2026-05-13 |
| splunk |
Windows Hide Notification Features Through Registry |
production |
2026-05-13 |
| splunk |
Windows Hidden Schedule Task Settings |
production |
2026-05-13 |
| splunk |
Windows Group Discovery Via Net |
production |
2026-05-13 |
| splunk |
Windows GrimResource - MMC Process Accessing APDS DLL |
production |
2026-05-13 |
| splunk |
Windows Global Object Access Audit List Cleared Via Auditpol |
production |
2026-05-13 |
| splunk |
Windows Get-Variable.EXE Execution from WindowsApps Folder |
production |
2026-05-13 |
| splunk |
Windows Get Local Admin with FindLocalAdminAccess |
production |
2026-05-13 |
| splunk |
Windows Get-AdComputer Unconstrained Delegation Discovery |
production |
2026-05-13 |
| splunk |
Windows Entra User Management Via Azure CLI |
production |
2026-05-13 |
| splunk |
Windows Enable Win32 ScheduledJob via Registry |
production |
2026-05-13 |
| splunk |
Windows Enable PowerShell Web Access |
production |
2026-05-13 |
| splunk |
Windows EFI Volume Mount Attempt Via Mountvol |
production |
2026-05-13 |
| splunk |
Windows EFI Bootloader File Modification |
production |
2026-05-13 |
| splunk |
Windows Guest Account Enabled Via Net.EXE |
production |
2026-05-13 |
| splunk |
Windows Drivers Loaded by Signature |
production |
2026-05-13 |
| splunk |
Windows Driver Load Non-Standard Path |
production |
2026-05-13 |
| splunk |
Windows Driver Inventory |
production |
2026-05-13 |
| splunk |
Windows Downdate Registry Activity |
production |
2026-05-13 |
| splunk |
Windows Domain Account Discovery Via Get-NetComputer |
production |
2026-05-13 |
| splunk |
Windows DnsAdmins New Member Added |
production |
2026-05-13 |
| splunk |
Windows DNS Query Request To TinyUrl |
production |
2026-05-13 |
| splunk |
Windows DNS Gather Network Info |
production |
2026-05-13 |
| splunk |
Windows DLL Side-Loading Process Child Of Calc |
production |
2026-05-13 |