| splunk |
Windows App Layer Protocol Qakbot NamedPipe |
production |
2026-05-13 |
| splunk |
Windows Application Layer Protocol RMS Radmin Tool Namedpipe |
production |
2026-05-13 |
| splunk |
Windows Application Whitelisting Bypass Attempt via Rundll32 |
production |
2026-05-13 |
| splunk |
Windows AppLocker Execution from Uncommon Locations |
production |
2026-05-13 |
| splunk |
Windows AppLocker Rare Application Launch Detection |
production |
2026-05-13 |
| splunk |
Windows AppX Deployment Full Trust Package Installation |
production |
2026-05-13 |
| splunk |
Windows AppX Deployment Package Installation Success |
production |
2026-05-13 |
| splunk |
Windows AppX Deployment Unsigned Package Installation |
production |
2026-05-13 |
| splunk |
Windows Archive Collected Data via Powershell |
production |
2026-05-13 |
| splunk |
Windows Archive Collected Data via Rar |
production |
2026-05-13 |
| splunk |
Windows Archived Collected Data In TEMP Folder |
production |
2026-05-13 |
| splunk |
Windows Audit Policy Auditing Option Disabled via Auditpol |
production |
2026-05-13 |
| splunk |
Windows Audit Policy Auditing Option Modified - Registry |
production |
2026-05-13 |
| splunk |
Windows Audit Policy Cleared via Auditpol |
production |
2026-05-13 |
| splunk |
Windows Audit Policy Disabled via Auditpol |
production |
2026-05-13 |
| splunk |
Windows Audit Policy Disabled via Legacy Auditpol |
production |
2026-05-13 |
| splunk |
Windows Audit Policy Excluded Category via Auditpol |
production |
2026-05-13 |
| splunk |
Windows Audit Policy Restored via Auditpol |
production |
2026-05-13 |
| splunk |
Windows Audit Policy Security Descriptor Tampering via Auditpol |
production |
2026-05-13 |
| splunk |
Windows AutoIt3 Execution |
production |
2026-05-13 |
| splunk |
Windows Autostart Execution LSASS Driver Registry Modification |
production |
2026-05-13 |
| splunk |
Windows Azure PowerShell Module Installation Via PowerShell Script |
production |
2026-05-13 |
| splunk |
Windows Azure Storage Utility Execution Via CLI |
production |
2026-05-13 |
| splunk |
Windows Binary Execution from an Archive |
experimental |
2026-05-13 |
| splunk |
Windows Binary Proxy Execution Mavinject DLL Injection |
production |
2026-05-13 |
| splunk |
Windows BitDefender Submission Wizard DLL Sideloading |
experimental |
2026-05-13 |
| splunk |
Windows BitLocker Suspicious Command Usage |
production |
2026-05-13 |
| splunk |
Windows BitLockerToGo Process Execution |
production |
2026-05-13 |
| splunk |
Windows BitLockerToGo with Network Activity |
production |
2026-05-13 |
| splunk |
Windows Bluetooth Service Installed From Uncommon Location |
production |
2026-05-13 |
| splunk |
Windows BootLoader Inventory |
experimental |
2026-05-13 |
| splunk |
Windows Bypass UAC via Pkgmgr Tool |
production |
2026-05-13 |
| splunk |
Windows Cabinet File Extraction Via Expand |
production |
2026-05-13 |
| splunk |
Windows Cached Domain Credentials Reg Query |
production |
2026-05-13 |
| splunk |
Windows Certutil Root Certificate Addition |
production |
2026-05-13 |
| splunk |
Windows Change File Association Command To Notepad |
production |
2026-05-13 |
| splunk |
Windows Chrome Auto-Update Disabled via Registry |
production |
2026-05-13 |
| splunk |
Windows Chrome Enable Extension Loading via Command-Line |
production |
2026-05-13 |
| splunk |
Windows Chrome Extension Allowed Registry Modification |
production |
2026-05-13 |
| splunk |
Windows Chromium Browser Launched with Small Window Size |
production |
2026-05-13 |