| splunk |
Services Escalate Exe |
production |
2026-05-13 |
| splunk |
ServicePrincipalNames Discovery with SetSPN |
production |
2026-05-13 |
| splunk |
ServicePrincipalNames Discovery with PowerShell |
production |
2026-05-13 |
| splunk |
SecretDumps Offline NTDS Dumping Tool |
production |
2026-05-13 |
| splunk |
SearchProtocolHost with no Command Line with Network |
production |
2026-05-13 |
| splunk |
Sdelete Application Execution |
production |
2026-05-13 |
| splunk |
Sdclt UAC Bypass |
production |
2026-05-13 |
| splunk |
Script Execution via WMI |
production |
2026-05-13 |
| splunk |
Screensaver Event Trigger Execution |
production |
2026-05-13 |
| splunk |
Schtasks used for forcing a reboot |
production |
2026-05-13 |
| splunk |
Schtasks scheduling job on remote system |
production |
2026-05-13 |
| splunk |
Schtasks Run Task On Demand |
production |
2026-05-13 |
| splunk |
Scheduled Task Initiation on Remote Endpoint |
production |
2026-05-13 |
| splunk |
Scheduled Task Deleted Or Created via CMD |
production |
2026-05-13 |
| splunk |
Scheduled Task Creation on Remote Endpoint using At |
production |
2026-05-13 |
| splunk |
Schedule Task with Rundll32 Command Trigger |
production |
2026-05-13 |
| splunk |
Schedule Task with HTTP Command Arguments |
production |
2026-05-13 |
| splunk |
SchCache Change By App Connect And Create ADSI Object |
production |
2026-05-13 |
| splunk |
Samsam Test File Write |
production |
2026-05-13 |
| splunk |
SAM Database File Access Attempt |
production |
2026-05-13 |
| splunk |
Ryuk Wake on LAN Command |
production |
2026-05-13 |
| splunk |
Ryuk Test Files Detected |
production |
2026-05-13 |
| splunk |
RunDLL Loading DLL By Ordinal |
production |
2026-05-13 |
| splunk |
Rundll32 with no Command Line Arguments with Network |
production |
2026-05-13 |
| splunk |
Rundll32 Shimcache Flush |
production |
2026-05-13 |
| splunk |
Rundll32 Process Creating Exe Dll Files |
production |
2026-05-13 |
| splunk |
Rundll32 LockWorkStation |
production |
2026-05-13 |
| splunk |
Rundll32 Control RunDLL World Writable Directory |
production |
2026-05-13 |
| splunk |
Rundll32 Control RunDLL Hunt |
production |
2026-05-13 |
| splunk |
Runas Execution in CommandLine |
production |
2026-05-13 |
| splunk |
Rubeus Command Line Parameters |
production |
2026-05-13 |
| splunk |
Revil Registry Entry |
production |
2026-05-13 |
| splunk |
Revil Common Exec Parameter |
production |
2026-05-13 |
| splunk |
Resize ShadowStorage volume |
production |
2026-05-13 |
| splunk |
Remote WMI Command Attempt |
production |
2026-05-13 |
| splunk |
Remote System Discovery with Wmic |
production |
2026-05-13 |
| splunk |
Remote System Discovery with Dsquery |
production |
2026-05-13 |
| splunk |
Remote System Discovery with Adsisearcher |
production |
2026-05-13 |
| splunk |
MOVEit Empty Key Fingerprint Authentication Attempt |
production |
2026-05-13 |
| splunk |
MOVEit Certificate Store Access Failure |
production |
2026-05-13 |