| splunk |
Cisco SNMP Community String Configuration Changes |
production |
2026-05-13 |
| splunk |
Cisco TFTP Server Configuration for Data Exfiltration |
production |
2026-05-13 |
| splunk |
Detect ARP Poisoning |
experimental |
2026-05-13 |
| splunk |
Detect DNS Query to Decommissioned S3 Bucket |
experimental |
2026-05-13 |
| splunk |
Detect IPv6 Network Infrastructure Threats |
experimental |
2026-05-13 |
| splunk |
Detect Large ICMP Traffic |
production |
2026-05-13 |
| splunk |
Detect Outbound LDAP Traffic |
production |
2026-05-13 |
| splunk |
Detect Outbound SMB Traffic |
production |
2026-05-13 |
| splunk |
Detect Port Security Violation |
experimental |
2026-05-13 |
| splunk |
Detect Rogue DHCP Server |
experimental |
2026-05-13 |
| splunk |
Detect SNICat SNI Exfiltration |
experimental |
2026-05-13 |
| splunk |
Detect Software Download To Network Device |
experimental |
2026-05-13 |
| splunk |
Detect Traffic Mirroring |
experimental |
2026-05-13 |
| splunk |
Detect Unauthorized Assets by MAC address |
experimental |
2026-05-13 |
| splunk |
Detect Windows DNS SIGRed via Splunk Stream |
experimental |
2026-05-13 |
| splunk |
Detect Windows DNS SIGRed via Zeek |
experimental |
2026-05-13 |
| splunk |
Detect Zerologon via Zeek |
experimental |
2026-05-13 |
| splunk |
DNS Query Length With High Standard Deviation |
production |
2026-05-13 |
| splunk |
Excessive DNS Failures |
experimental |
2026-05-13 |
| splunk |
F5 BIG-IP iControl REST Vulnerability CVE-2022-1388 |
production |
2026-05-13 |
| splunk |
HTTP Rapid POST with Mixed Status Codes |
production |
2026-05-13 |
| splunk |
Hosts receiving high volume of network traffic from email server |
experimental |
2026-05-13 |
| splunk |
Internal Horizontal Port Scan |
production |
2026-05-13 |
| splunk |
Internal Vertical Port Scan |
production |
2026-05-13 |
| splunk |
Large Volume of DNS ANY Queries |
experimental |
2026-05-13 |
| splunk |
Ngrok Reverse Proxy on Network |
production |
2026-05-13 |
| splunk |
Protocol or Port Mismatch |
production |
2026-05-13 |
| splunk |
Protocols passing authentication in cleartext |
production |
2026-05-13 |
| splunk |
Remote Desktop Network Traffic |
production |
2026-05-13 |
| splunk |
Rundll32 DNSQuery |
production |
2026-05-13 |
| splunk |
SMB Traffic Spike |
experimental |
2026-05-13 |
| splunk |
SSL Certificates with Punycode |
experimental |
2026-05-13 |
| splunk |
Suspicious Process DNS Query Known Abuse Web Services |
production |
2026-05-13 |
| splunk |
TOR Traffic |
production |
2026-05-13 |
| splunk |
HTTP Request to Reserved Name on IIS Server |
production |
2026-05-13 |
| splunk |
Wermgr Process Connecting To IP Check Web Services |
production |
2026-05-13 |
| splunk |
Windows Abused Web Services |
production |
2026-05-13 |
| splunk |
Windows AD Replication Service Traffic |
experimental |
2026-05-13 |
| splunk |
Windows AD Rogue Domain Controller Network Activity |
experimental |
2026-05-13 |
| splunk |
Windows Multi hop Proxy TOR Website Query |
production |
2026-05-13 |