| splunk |
Detect Windows DNS SIGRed via Zeek |
experimental |
2026-05-13 |
| splunk |
Cisco Secure Firewall - Citrix NetScaler Memory Overread Attempt |
production |
2026-05-13 |
| splunk |
Cisco Secure Firewall - Bits Network Activity |
production |
2026-05-13 |
| splunk |
Cisco SD-WAN - Uncommon User-Agent Multi-URI Activity |
production |
2026-05-13 |
| splunk |
Cisco SD-WAN - Peering Activity |
production |
2026-05-13 |
| splunk |
Cisco SD-WAN - Low Frequency Rogue Peer |
production |
2026-05-13 |
| splunk |
Cisco Secure Firewall - Blocked Connection |
production |
2026-05-13 |
| splunk |
Cisco SD-WAN - Arbitrary File Overwrite Exploitation Activity |
production |
2026-05-13 |
| splunk |
Cisco Privileged Account Creation with Suspicious SSH Activity |
production |
2026-05-13 |
| splunk |
Cisco Privileged Account Creation with HTTP Command Execution |
production |
2026-05-13 |
| splunk |
Cisco Network Interface Modifications |
production |
2026-05-13 |
| splunk |
Cisco IOS Suspicious Privileged Account Creation |
production |
2026-05-13 |
| splunk |
Cisco Configuration Archive Logging Analysis |
production |
2026-05-13 |
| splunk |
XSL Script Execution With WMIC |
production |
2026-05-13 |
| splunk |
WSReset UAC Bypass |
production |
2026-05-13 |
| splunk |
Wsmprovhost LOLBAS Execution Process Spawn |
production |
2026-05-13 |
| splunk |
Wmiprvse LOLBAS Execution Process Spawn |
production |
2026-05-13 |
| splunk |
Wmic NonInteractive App Uninstallation |
production |
2026-05-13 |
| splunk |
Wmic Group Discovery |
production |
2026-05-13 |
| splunk |
WMI Recon Running Process Or Services |
production |
2026-05-13 |
| splunk |
WinRM Spawning a Process |
experimental |
2026-05-13 |
| splunk |
WinRAR Spawning Shell Application |
production |
2026-05-13 |
| splunk |
Winhlp32 Spawning a Process |
production |
2026-05-13 |
| splunk |
WinEvent Windows Task Scheduler Event Action Started |
production |
2026-05-13 |
| splunk |
WinEvent Scheduled Task Created Within Public Path |
production |
2026-05-13 |
| splunk |
WinEvent Scheduled Task Created to Spawn Shell |
production |
2026-05-13 |
| splunk |
Windows XLL File Creation Outside of Typical Location |
production |
2026-05-13 |
| splunk |
Windows WSUS Spawning Shell |
production |
2026-05-13 |
| splunk |
Windows WPDBusEnum Registry Key Modification |
production |
2026-05-13 |
| splunk |
Windows Wmic Systeminfo Discovery |
production |
2026-05-13 |
| splunk |
Windows WMIC Shadowcopy Delete |
production |
2026-05-13 |
| splunk |
Windows Wmic Network Discovery |
production |
2026-05-13 |
| splunk |
Windows Wmic Memory Chip Discovery |
production |
2026-05-13 |
| splunk |
Windows Wmic DiskDrive Discovery |
production |
2026-05-13 |
| splunk |
Windows Wmic CPU Discovery |
production |
2026-05-13 |
| splunk |
Windows WMI Reconnaissance Class Query |
production |
2026-05-13 |
| splunk |
Windows WMI Process Call Create |
production |
2026-05-13 |
| splunk |
Windows WMI Process And Service List |
production |
2026-05-13 |
| splunk |
Windows TeamCity Plugin Installed |
production |
2026-05-13 |
| splunk |
Windows TeamCity Payload Execution from Temp Directory |
production |
2026-05-13 |