| splunk |
Ransomware Notes bulk creation |
production |
2026-05-13 |
| splunk |
Randomly Generated Windows Service Name |
experimental |
2026-05-13 |
| splunk |
Randomly Generated Scheduled Task Name |
experimental |
2026-05-13 |
| splunk |
Processes Tapping Keyboard Events |
experimental |
2026-05-13 |
| splunk |
Process Writing DynamicWrapperX |
production |
2026-05-13 |
| splunk |
Process Kill Base On File Path |
production |
2026-05-13 |
| splunk |
Process Execution via WMI |
production |
2026-05-13 |
| splunk |
Process Deleting Its Process File Path |
production |
2026-05-13 |
| splunk |
Process Creating LNK file in Suspicious Location |
production |
2026-05-13 |
| splunk |
Print Spooler Failed to Load a Plug-in |
production |
2026-05-13 |
| splunk |
Print Spooler Adding A Printer Driver |
production |
2026-05-13 |
| splunk |
Print Processor Registry Autostart |
production |
2026-05-13 |
| splunk |
ESXi System Clock Manipulation |
production |
2026-05-13 |
| splunk |
Prevent Automatic Repair Mode using Bcdedit |
production |
2026-05-13 |
| splunk |
PowerShell WebRequest Using Memory Stream |
production |
2026-05-13 |
| splunk |
MacOS Network Share Discovery |
production |
2026-05-13 |
| splunk |
Microsoft Intune Mobile Apps |
experimental |
2026-05-13 |
| splunk |
Cisco AI Defense Security Alerts by Application Name |
production |
2026-05-13 |
| splunk |
ESXi External Root Login Activity |
production |
2026-05-13 |
| splunk |
Cisco ASA - AAA Policy Tampering |
production |
2026-05-13 |
| splunk |
Cisco ASA - Core Syslog Message Volume Drop |
production |
2026-05-13 |
| splunk |
Cisco ASA - Device File Copy Activity |
production |
2026-05-13 |
| splunk |
Cisco ASA - Device File Copy to Remote Location |
production |
2026-05-13 |
| splunk |
Cisco ASA - Logging Disabled via CLI |
production |
2026-05-13 |
| splunk |
ESXi Firewall Disabled |
production |
2026-05-13 |
| splunk |
Cisco ASA - Logging Filters Configuration Tampering |
production |
2026-05-13 |
| splunk |
Cisco ASA - Logging Message Suppression |
production |
2026-05-13 |
| splunk |
Cisco ASA - New Local User Account Created |
production |
2026-05-13 |
| splunk |
Cisco ASA - Packet Capture Activity |
production |
2026-05-13 |
| splunk |
Cisco Duo Policy Allow Old Java |
production |
2026-05-13 |
| splunk |
Cisco ASA - Reconnaissance Command Activity |
production |
2026-05-13 |
| splunk |
Cisco ASA - User Account Deleted From Local Database |
production |
2026-05-13 |
| splunk |
Cisco ASA - User Account Lockout Threshold Exceeded |
production |
2026-05-13 |
| splunk |
Cisco ASA - User Privilege Level Change |
production |
2026-05-13 |
| splunk |
M365 Copilot Application Usage Pattern Anomalies |
production |
2026-05-13 |
| splunk |
M365 Copilot Failed Authentication Patterns |
production |
2026-05-13 |
| splunk |
Geographic Improbable Location |
experimental |
2026-05-13 |
| splunk |
M365 Copilot Non Compliant Devices Accessing M365 Copilot |
production |
2026-05-13 |
| splunk |
M365 Copilot Session Origin Anomalies |
production |
2026-05-13 |
| splunk |
MCP Filesystem Server Suspicious Extension Write |
production |
2026-05-13 |