| splunk |
Cisco Configuration Archive Logging Analysis |
production |
2026-05-13 |
| splunk |
Cisco IOS Suspicious Privileged Account Creation |
production |
2026-05-13 |
| splunk |
Cisco SD-WAN - Arbitrary File Overwrite Exploitation Activity |
production |
2026-05-13 |
| splunk |
Cisco Privileged Account Creation with Suspicious SSH Activity |
production |
2026-05-13 |
| splunk |
Cisco Privileged Account Creation with HTTP Command Execution |
production |
2026-05-13 |
| splunk |
WinEvent Scheduled Task Created Within Public Path |
production |
2026-05-13 |
| splunk |
WinRM Spawning a Process |
experimental |
2026-05-13 |
| splunk |
Wmiprvse LOLBAS Execution Process Spawn |
production |
2026-05-13 |
| splunk |
Winhlp32 Spawning a Process |
production |
2026-05-13 |
| splunk |
Cisco Secure Firewall - Citrix NetScaler Memory Overread Attempt |
production |
2026-05-13 |
| splunk |
Cisco Secure Firewall - Bits Network Activity |
production |
2026-05-13 |
| splunk |
Remote Process Instantiation via WinRM and PowerShell |
production |
2026-05-13 |
| splunk |
Remote Process Instantiation via WinRM and PowerShell Script Block |
production |
2026-05-13 |
| splunk |
Remote Process Instantiation via WinRM and Winrs |
production |
2026-05-13 |
| splunk |
Remote Process Instantiation via WMI |
production |
2026-05-13 |
| splunk |
Remote Process Instantiation via WMI and PowerShell |
production |
2026-05-13 |
| splunk |
Remote Process Instantiation via WMI and PowerShell Script Block |
production |
2026-05-13 |
| splunk |
System Information Discovery Detection |
production |
2026-05-13 |
| splunk |
System User Discovery With Query |
production |
2026-05-13 |
| splunk |
Trickbot Named Pipe |
production |
2026-05-13 |
| splunk |
UAC Bypass MMC Load Unsigned Dll |
production |
2026-05-13 |
| splunk |
UAC Bypass With Colorui COM Object |
production |
2026-05-13 |
| splunk |
Uninstall App Using MsiExec |
production |
2026-05-13 |
| splunk |
Unknown Process Using The Kerberos Protocol |
production |
2026-05-13 |
| splunk |
Unload Sysmon Filter Driver |
production |
2026-05-13 |
| splunk |
Unloading AMSI via Reflection |
production |
2026-05-13 |
| splunk |
Unusual Number of Computer Service Tickets Requested |
experimental |
2026-05-13 |
| splunk |
Unusual Number of Kerberos Service Tickets Requested |
production |
2026-05-13 |
| splunk |
Unusual Number of Remote Endpoint Authentication Events |
experimental |
2026-05-13 |
| splunk |
Unusually Long Command Line |
experimental |
2026-05-13 |
| splunk |
User Discovery With Env Vars PowerShell |
production |
2026-05-13 |
| splunk |
User Discovery With Env Vars PowerShell Script Block |
production |
2026-05-13 |
| splunk |
USN Journal Deletion |
production |
2026-05-13 |
| splunk |
Verclsid CLSID Execution |
production |
2026-05-13 |
| splunk |
WBAdmin Delete System Backups |
production |
2026-05-13 |
| splunk |
Wbemprox COM Object Execution |
production |
2026-05-13 |
| splunk |
Web or Application Server Spawning a Shell |
production |
2026-05-13 |
| splunk |
Web Servers Executing Suspicious Processes |
experimental |
2026-05-13 |
| splunk |
Wermgr Process Create Executable File |
production |
2026-05-13 |
| splunk |
Wermgr Process Spawned CMD Or Powershell Process |
production |
2026-05-13 |