| splunk |
Detect New Local Admin account |
production |
2026-05-13 |
| splunk |
CMLUA Or CMSTPLUA UAC Bypass |
production |
2026-05-13 |
| splunk |
CMD Echo Pipe - Escalation |
production |
2026-05-13 |
| splunk |
CMD Carry Out String Command Parameter |
production |
2026-05-13 |
| splunk |
Clop Ransomware Known Service Name |
production |
2026-05-13 |
| splunk |
Clop Common Exec Parameter |
production |
2026-05-13 |
| splunk |
Clear Unallocated Sector Using Cipher App |
production |
2026-05-13 |
| splunk |
Crowdstrike Medium Identity Risk Severity |
production |
2026-05-13 |
| splunk |
Cisco Isovalent - Shell Execution |
production |
2026-05-13 |
| splunk |
Cisco Isovalent - Potential Escape to Host |
production |
2026-05-13 |
| splunk |
Cisco Isovalent - Pods Running Offensive Tools |
production |
2026-05-13 |
| splunk |
Cisco Isovalent - Nsenter Usage in Kubernetes Pod |
production |
2026-05-13 |
| splunk |
Cisco Isovalent - Non Allowlisted Image Use |
production |
2026-05-13 |
| splunk |
Cisco Isovalent - Late Process Execution |
production |
2026-05-13 |
| splunk |
Cisco Isovalent - Kprobe Spike |
production |
2026-05-13 |
| splunk |
Cisco Isovalent - Curl Execution With Insecure Flags |
production |
2026-05-13 |
| splunk |
Cisco Isovalent - Cron Job Creation |
production |
2026-05-13 |
| splunk |
Cisco Isovalent - Access To Cloud Metadata Service |
production |
2026-05-13 |
| splunk |
Check Elevated CMD using whoami |
production |
2026-05-13 |
| splunk |
Change To Safe Mode With Network Config |
production |
2026-05-13 |
| splunk |
CertUtil With Decode Argument |
production |
2026-05-13 |
| splunk |
Certutil exe certificate extraction |
production |
2026-05-13 |
| splunk |
BITSAdmin Download File |
production |
2026-05-13 |
| splunk |
BITS Job Persistence |
production |
2026-05-13 |
| splunk |
BCDEdit Failure Recovery Modification |
production |
2026-05-13 |
| splunk |
Bcdedit Command Back To Normal Mode Boot |
production |
2026-05-13 |
| splunk |
Auto Admin Logon Registry Entry |
production |
2026-05-13 |
| splunk |
Anomalous usage of 7zip |
production |
2026-05-13 |
| splunk |
Allow Operation with Consent Admin |
production |
2026-05-13 |
| splunk |
Allow Network Discovery In Firewall |
production |
2026-05-13 |
| splunk |
O365 Mailbox Folder Read Permission Assigned |
production |
2026-05-13 |
| splunk |
O365 Mailbox Email Forwarding Enabled |
production |
2026-05-13 |
| splunk |
O365 Mail Permissioned Application Consent Granted by User |
production |
2026-05-13 |
| splunk |
O365 High Privilege Role Granted |
production |
2026-05-13 |
| splunk |
O365 High Number Of Failed Authentications for User |
production |
2026-05-13 |
| splunk |
O365 FullAccessAsApp Permission Assigned |
production |
2026-05-13 |
| splunk |
O365 SharePoint Allowed Domains Policy Changed |
production |
2026-05-13 |
| splunk |
O365 File Permissioned Application Consent Granted by User |
production |
2026-05-13 |
| splunk |
O365 External Identity Policy Changed |
production |
2026-05-13 |
| splunk |
O365 External Guest User Invited |
production |
2026-05-13 |