| splunk |
Windows PsTools Recon Usage |
production |
2026-05-13 |
| splunk |
Windows PuTTY Suite Utility Execution |
production |
2026-05-13 |
| splunk |
Windows Query Registry Browser List Application |
production |
2026-05-13 |
| splunk |
Windows Raccine Scheduled Task Deletion |
production |
2026-05-13 |
| splunk |
Windows Rapid Authentication On Multiple Hosts |
production |
2026-05-13 |
| splunk |
Windows Rasautou DLL Execution |
production |
2026-05-13 |
| splunk |
Windows Raw Access To Disk Volume Partition |
production |
2026-05-13 |
| splunk |
Windows Raw Access To Master Boot Record Drive |
production |
2026-05-13 |
| splunk |
Windows RDP Bitmap Cache File Creation |
production |
2026-05-13 |
| splunk |
Windows RDP Client Launched with Admin Session |
production |
2026-05-13 |
| splunk |
Windows RDP Connection Successful |
production |
2026-05-13 |
| splunk |
Windows RDP File Execution |
production |
2026-05-13 |
| splunk |
Windows RDP Login Session Was Established |
production |
2026-05-13 |
| splunk |
Windows RDP Server Registry Deletion |
production |
2026-05-13 |
| splunk |
Windows Remote Access Software BRC4 Loaded Dll |
production |
2026-05-13 |
| splunk |
Windows RDP Server Registry Entry Created |
production |
2026-05-13 |
| splunk |
Windows RDPClient Connection Sequence Events |
production |
2026-05-13 |
| splunk |
Windows Registry BootExecute Modification |
production |
2026-05-13 |
| splunk |
Windows Registry Certificate Added |
production |
2026-05-13 |
| splunk |
Windows Registry Delete Task SD |
production |
2026-05-13 |
| splunk |
Windows Remote Access Software RMS Registry |
production |
2026-05-13 |
| splunk |
Windows Registry Entries Exported Via Reg |
production |
2026-05-13 |
| splunk |
Windows Registry Entries Restored Via Reg |
production |
2026-05-13 |
| splunk |
Windows Registry Modification for Safe Mode Persistence |
production |
2026-05-13 |
| splunk |
Windows Registry Payload Injection |
production |
2026-05-13 |
| splunk |
Windows Registry SIP Provider Modification |
production |
2026-05-13 |
| splunk |
Windows Remote Assistance Spawning Process |
production |
2026-05-13 |
| splunk |
Windows Remote Create Service |
production |
2026-05-13 |
| splunk |
Windows Remote Host Computer Management Access |
production |
2026-05-13 |
| splunk |
Windows Remote Image Load |
production |
2026-05-13 |
| splunk |
Windows Remote Management Execute Shell |
production |
2026-05-13 |
| splunk |
Windows Remote Service Rdpwinst Tool Execution |
production |
2026-05-13 |
| splunk |
Windows Service Stop By Deletion |
production |
2026-05-13 |
| splunk |
Windows Service Stop Win Updates |
production |
2026-05-13 |
| splunk |
Windows Set Custom DNS ServerLevelPlugin Via Dnscmd |
production |
2026-05-13 |
| splunk |
Windows Set Network Profile Category to Private via Registry |
production |
2026-05-13 |
| splunk |
Windows SharePoint Spinstall0 Webshell File Creation |
production |
2026-05-13 |
| splunk |
Windows Shell Process from CrushFTP |
production |
2026-05-13 |
| splunk |
Windows Short Lived DNS Record |
production |
2026-05-13 |
| splunk |
Windows SIP Provider Inventory |
production |
2026-05-13 |