| splunk |
Shai-Hulud Workflow File Creation or Modification |
production |
2026-05-13 |
| splunk |
Services LOLBAS Execution Process Spawn |
production |
2026-05-13 |
| splunk |
Services Escalate Exe |
production |
2026-05-13 |
| splunk |
ServicePrincipalNames Discovery with SetSPN |
production |
2026-05-13 |
| splunk |
ServicePrincipalNames Discovery with PowerShell |
production |
2026-05-13 |
| splunk |
SecretDumps Offline NTDS Dumping Tool |
production |
2026-05-13 |
| splunk |
SearchProtocolHost with no Command Line with Network |
production |
2026-05-13 |
| splunk |
Sdelete Application Execution |
production |
2026-05-13 |
| splunk |
Sdclt UAC Bypass |
production |
2026-05-13 |
| splunk |
Script Execution via WMI |
production |
2026-05-13 |
| splunk |
Screensaver Event Trigger Execution |
production |
2026-05-13 |
| splunk |
Schtasks used for forcing a reboot |
production |
2026-05-13 |
| splunk |
Schtasks scheduling job on remote system |
production |
2026-05-13 |
| splunk |
Schtasks Run Task On Demand |
production |
2026-05-13 |
| splunk |
Scheduled Task Initiation on Remote Endpoint |
production |
2026-05-13 |
| splunk |
Scheduled Task Deleted Or Created via CMD |
production |
2026-05-13 |
| splunk |
Scheduled Task Creation on Remote Endpoint using At |
production |
2026-05-13 |
| splunk |
Schedule Task with Rundll32 Command Trigger |
production |
2026-05-13 |
| splunk |
Schedule Task with HTTP Command Arguments |
production |
2026-05-13 |
| splunk |
SchCache Change By App Connect And Create ADSI Object |
production |
2026-05-13 |
| splunk |
Samsam Test File Write |
production |
2026-05-13 |
| splunk |
SAM Database File Access Attempt |
production |
2026-05-13 |
| splunk |
Ryuk Wake on LAN Command |
production |
2026-05-13 |
| splunk |
Ryuk Test Files Detected |
production |
2026-05-13 |
| splunk |
Notepad with no Command Line Arguments |
production |
2026-05-13 |
| splunk |
NLTest Domain Trust Discovery |
production |
2026-05-13 |
| splunk |
Nishang PowershellTCPOneLine |
production |
2026-05-13 |
| splunk |
Network Traffic to Active Directory Web Services Protocol |
production |
2026-05-13 |
| splunk |
Network Discovery Using Route Windows App |
production |
2026-05-13 |
| splunk |
Network Connection Discovery With Netstat |
production |
2026-05-13 |
| splunk |
NET Profiler UAC bypass |
production |
2026-05-13 |
| splunk |
Msmpeng Application DLL Side Loading |
production |
2026-05-13 |
| splunk |
MSI Module Loaded by Non-System Binary |
production |
2026-05-13 |
| splunk |
Mshta spawning Rundll32 OR Regsvr32 Process |
production |
2026-05-13 |
| splunk |
MSBuild Suspicious Spawned By Script Process |
production |
2026-05-13 |
| splunk |
MS Scripting Process Loading WMI Module |
production |
2026-05-13 |
| splunk |
MS Scripting Process Loading Ldap Module |
production |
2026-05-13 |
| splunk |
MS Exchange Mailbox Replication service writing Active Server Pages |
experimental |
2026-05-13 |
| splunk |
MOVEit Empty Key Fingerprint Authentication Attempt |
production |
2026-05-13 |
| splunk |
MOVEit Certificate Store Access Failure |
production |
2026-05-13 |