| splunk |
Windows Registry Modification for Safe Mode Persistence |
production |
2026-05-13 |
| splunk |
Windows Registry Payload Injection |
production |
2026-05-13 |
| splunk |
Windows Registry SIP Provider Modification |
production |
2026-05-13 |
| splunk |
Windows Remote Assistance Spawning Process |
production |
2026-05-13 |
| splunk |
Windows Remote Create Service |
production |
2026-05-13 |
| splunk |
Windows Remote Host Computer Management Access |
production |
2026-05-13 |
| splunk |
Windows Remote Image Load |
production |
2026-05-13 |
| splunk |
Windows Remote Management Execute Shell |
production |
2026-05-13 |
| splunk |
Windows Remote Service Rdpwinst Tool Execution |
production |
2026-05-13 |
| splunk |
Windows Remote Services Allow Rdp In Firewall |
production |
2026-05-13 |
| splunk |
Windows Remote Services Allow Remote Assistance |
production |
2026-05-13 |
| splunk |
Windows Remote Services Rdp Enable |
production |
2026-05-13 |
| splunk |
Windows Replication Through Removable Media |
production |
2026-05-13 |
| splunk |
Windows Root Domain linked policies Discovery |
production |
2026-05-13 |
| splunk |
Windows Routing and Remote Access Service Registry Key Change |
production |
2026-05-13 |
| splunk |
Windows Rundll32 Apply User Settings Changes |
production |
2026-05-13 |
| splunk |
Windows Rundll32 Execution With Log.DLL |
production |
2026-05-13 |
| splunk |
Windows Rundll32 Load DLL in Temp Dir |
production |
2026-05-13 |
| splunk |
Windows Rundll32 WebDAV Request |
production |
2026-05-13 |
| splunk |
Windows Rundll32 WebDav With Network Connection |
production |
2026-05-13 |
| splunk |
Windows Rundll32 with Non-Standard File Extension |
production |
2026-05-13 |
| splunk |
Windows RunMRU Command Execution |
production |
2026-05-13 |
| splunk |
Windows RunMRU Registry Key or Value Deleted |
production |
2026-05-13 |
| splunk |
Windows Scheduled Task Created in a Group Policy Object |
production |
2026-05-13 |
| splunk |
Windows Scheduled Task Created Via XML |
production |
2026-05-13 |
| splunk |
Windows Scheduled Task DLL Module Loaded |
production |
2026-05-13 |
| splunk |
Windows Scheduled Task with Highest Privileges |
production |
2026-05-13 |
| splunk |
Windows SQL Server Startup Procedure |
production |
2026-05-13 |
| splunk |
Windows SQL Server xp_cmdshell Config Change |
production |
2026-05-13 |
| splunk |
Windows SQL Spawning CertUtil |
experimental |
2026-05-13 |
| splunk |
Windows SQLCMD Execution |
production |
2026-05-13 |
| splunk |
Windows Sqlservr Spawning Shell |
production |
2026-05-13 |
| splunk |
Windows SqlWriter SQLDumper DLL Sideload |
production |
2026-05-13 |
| splunk |
Windows Steal Authentication Certificates CryptoAPI |
production |
2026-05-13 |
| splunk |
Windows Steal Authentication Certificates - ESC1 Abuse |
production |
2026-05-13 |
| splunk |
Windows Steal Authentication Certificates - ESC1 Authentication |
production |
2026-05-13 |
| splunk |
Windows Steal Authentication Certificates Certificate Issued |
production |
2026-05-13 |
| splunk |
Windows Steal Authentication Certificates Certificate Request |
production |
2026-05-13 |
| splunk |
Windows Steal Authentication Certificates CertUtil Backup |
production |
2026-05-13 |
| splunk |
Windows Steal Authentication Certificates CS Backup |
production |
2026-05-13 |