| splunk |
Supernova Webshell |
experimental |
2026-05-13 |
| splunk |
VMware Workspace ONE Freemarker Server-side Template Injection |
production |
2026-05-13 |
| splunk |
ESXi Reverse Shell Patterns |
production |
2026-05-13 |
| splunk |
VMware Server Side Template Injection Hunt |
production |
2026-05-13 |
| splunk |
VMWare Aria Operations Exploit Attempt |
production |
2026-05-13 |
| splunk |
Tomcat Session Deserialization Attempt |
production |
2026-05-13 |
| splunk |
Windows BitDefender Submission Wizard DLL Sideloading |
experimental |
2026-05-13 |
| splunk |
ESXi Syslog Config Change |
production |
2026-05-13 |
| splunk |
Windows Binary Proxy Execution Mavinject DLL Injection |
production |
2026-05-13 |
| splunk |
Windows Binary Execution from an Archive |
experimental |
2026-05-13 |
| splunk |
Windows Azure Storage Utility Execution Via CLI |
production |
2026-05-13 |
| splunk |
Windows Azure PowerShell Module Installation Via PowerShell Script |
production |
2026-05-13 |
| splunk |
Windows Autostart Execution LSASS Driver Registry Modification |
production |
2026-05-13 |
| splunk |
Windows AutoIt3 Execution |
production |
2026-05-13 |
| splunk |
Windows Audit Policy Security Descriptor Tampering via Auditpol |
production |
2026-05-13 |
| splunk |
Windows Audit Policy Restored via Auditpol |
production |
2026-05-13 |
| splunk |
Windows Audit Policy Excluded Category via Auditpol |
production |
2026-05-13 |
| splunk |
Windows Audit Policy Disabled via Legacy Auditpol |
production |
2026-05-13 |
| splunk |
SilentCleanup UAC Bypass |
production |
2026-05-13 |
| splunk |
Short Lived Windows Accounts |
production |
2026-05-13 |
| splunk |
Shim Database Installation With Suspicious Parameters |
production |
2026-05-13 |
| splunk |
Kubernetes Anomalous Traffic on Network Edge |
experimental |
2026-05-13 |
| splunk |
Shim Database File Creation |
production |
2026-05-13 |
| splunk |
Kubernetes AWS detect suspicious kubectl calls |
experimental |
2026-05-13 |
| splunk |
Kubernetes Create or Update Privileged Pod |
production |
2026-05-13 |
| splunk |
Kubernetes Cron Job Creation |
production |
2026-05-13 |
| splunk |
Shai-Hulud Workflow File Creation or Modification |
production |
2026-05-13 |
| splunk |
Services LOLBAS Execution Process Spawn |
production |
2026-05-13 |
| splunk |
Services Escalate Exe |
production |
2026-05-13 |
| splunk |
Kubernetes DaemonSet Deployed |
production |
2026-05-13 |
| splunk |
Kubernetes Falco Shell Spawned |
production |
2026-05-13 |
| splunk |
ServicePrincipalNames Discovery with SetSPN |
production |
2026-05-13 |
| splunk |
ServicePrincipalNames Discovery with PowerShell |
production |
2026-05-13 |
| splunk |
SecretDumps Offline NTDS Dumping Tool |
production |
2026-05-13 |
| splunk |
SearchProtocolHost with no Command Line with Network |
production |
2026-05-13 |
| splunk |
Kubernetes newly seen TCP edge |
experimental |
2026-05-13 |
| splunk |
Kubernetes newly seen UDP edge |
experimental |
2026-05-13 |
| splunk |
Sdelete Application Execution |
production |
2026-05-13 |
| splunk |
Sdclt UAC Bypass |
production |
2026-05-13 |
| splunk |
Kubernetes Nginx Ingress RFI |
production |
2026-05-13 |