| splunk |
Linux Puppet Privilege Escalation |
production |
2026-05-13 |
| splunk |
Linux RPM Privilege Escalation |
production |
2026-05-13 |
| splunk |
Linux Ruby Privilege Escalation |
production |
2026-05-13 |
| splunk |
Linux Service File Created In Systemd Directory |
production |
2026-05-13 |
| splunk |
Linux Service Restarted |
production |
2026-05-13 |
| splunk |
Linux Service Started Or Enabled |
production |
2026-05-13 |
| splunk |
Linux Setuid Using Chmod Utility |
production |
2026-05-13 |
| splunk |
Linux Setuid Using Setcap Utility |
production |
2026-05-13 |
| splunk |
Linux Shred Overwrite Command |
production |
2026-05-13 |
| splunk |
Linux Sqlite3 Privilege Escalation |
production |
2026-05-13 |
| splunk |
Linux SSH Authorized Keys Modification |
production |
2026-05-13 |
| splunk |
Linux SSH Remote Services Script Execute |
production |
2026-05-13 |
| splunk |
MacOS Gatekeeper Bypass |
production |
2026-05-13 |
| splunk |
Linux Stdout Redirection To Dev Null File |
production |
2026-05-13 |
| splunk |
Linux Stop Services |
production |
2026-05-13 |
| splunk |
Linux Sudo OR Su Execution |
production |
2026-05-13 |
| splunk |
Linux Sudoers Tmp File Creation |
production |
2026-05-13 |
| splunk |
MS Exchange Mailbox Replication service writing Active Server Pages |
experimental |
2026-05-13 |
| splunk |
MS Scripting Process Loading Ldap Module |
production |
2026-05-13 |
| splunk |
MS Scripting Process Loading WMI Module |
production |
2026-05-13 |
| splunk |
MSBuild Suspicious Spawned By Script Process |
production |
2026-05-13 |
| splunk |
Mshta spawning Rundll32 OR Regsvr32 Process |
production |
2026-05-13 |
| splunk |
MSI Module Loaded by Non-System Binary |
production |
2026-05-13 |
| splunk |
Msmpeng Application DLL Side Loading |
production |
2026-05-13 |
| splunk |
NET Profiler UAC bypass |
production |
2026-05-13 |
| splunk |
Network Connection Discovery With Netstat |
production |
2026-05-13 |
| splunk |
Network Discovery Using Route Windows App |
production |
2026-05-13 |
| splunk |
Network Traffic to Active Directory Web Services Protocol |
production |
2026-05-13 |
| splunk |
Nishang PowershellTCPOneLine |
production |
2026-05-13 |
| splunk |
NLTest Domain Trust Discovery |
production |
2026-05-13 |
| splunk |
Notepad with no Command Line Arguments |
production |
2026-05-13 |
| splunk |
Ntdsutil Export NTDS |
production |
2026-05-13 |
| splunk |
Outbound Network Connection from Java Using Default Ports |
production |
2026-05-13 |
| splunk |
Overwriting Accessibility Binaries |
production |
2026-05-13 |
| splunk |
PaperCut NG Suspicious Behavior Debug Log |
production |
2026-05-13 |
| splunk |
Permission Modification using Takeown App |
production |
2026-05-13 |
| splunk |
PetitPotam Network Share Access Request |
production |
2026-05-13 |
| splunk |
Possible Browser Pass View Parameter |
production |
2026-05-13 |
| splunk |
Potential System Network Configuration Discovery Activity |
production |
2026-05-13 |
| splunk |
Potential Telegram API Request Via CommandLine |
production |
2026-05-13 |