| splunk |
Windows Process Commandline Discovery |
production |
2026-05-13 |
| splunk |
Windows Process Execution From RDP Share |
production |
2026-05-13 |
| splunk |
Windows Process Injection In Non-Service SearchIndexer |
production |
2026-05-13 |
| splunk |
Windows Process With NetExec Command Line Parameters |
production |
2026-05-13 |
| splunk |
Windows Process Writing File to World Writable Path |
production |
2026-05-13 |
| splunk |
Windows Processes Killed By Industroyer2 Malware |
production |
2026-05-13 |
| splunk |
Windows Protocol Tunneling with Plink |
production |
2026-05-13 |
| splunk |
Windows Proxy Via Netsh |
production |
2026-05-13 |
| splunk |
Windows Proxy Via Registry |
production |
2026-05-13 |
| splunk |
Windows PsTools Recon Usage |
production |
2026-05-13 |
| splunk |
Windows PuTTY Suite Utility Execution |
production |
2026-05-13 |
| splunk |
Windows Query Registry Browser List Application |
production |
2026-05-13 |
| splunk |
Windows Raccine Scheduled Task Deletion |
production |
2026-05-13 |
| splunk |
Windows Rapid Authentication On Multiple Hosts |
production |
2026-05-13 |
| splunk |
Windows Rasautou DLL Execution |
production |
2026-05-13 |
| splunk |
Windows Raw Access To Disk Volume Partition |
production |
2026-05-13 |
| splunk |
Windows Raw Access To Master Boot Record Drive |
production |
2026-05-13 |
| splunk |
Windows RDP Bitmap Cache File Creation |
production |
2026-05-13 |
| splunk |
Windows RDP Client Launched with Admin Session |
production |
2026-05-13 |
| splunk |
Windows RDP Connection Successful |
production |
2026-05-13 |
| splunk |
Windows RDP File Execution |
production |
2026-05-13 |
| splunk |
Windows RDP Login Session Was Established |
production |
2026-05-13 |
| splunk |
Windows RDP Server Registry Deletion |
production |
2026-05-13 |
| splunk |
Windows Remote Access Software BRC4 Loaded Dll |
production |
2026-05-13 |
| splunk |
Windows RDP Server Registry Entry Created |
production |
2026-05-13 |
| splunk |
Windows RDPClient Connection Sequence Events |
production |
2026-05-13 |
| splunk |
Windows Registry BootExecute Modification |
production |
2026-05-13 |
| splunk |
Windows Registry Certificate Added |
production |
2026-05-13 |
| splunk |
Windows Registry Delete Task SD |
production |
2026-05-13 |
| splunk |
Windows Remote Access Software RMS Registry |
production |
2026-05-13 |
| splunk |
Windows Registry Entries Exported Via Reg |
production |
2026-05-13 |
| splunk |
Windows Registry Entries Restored Via Reg |
production |
2026-05-13 |
| splunk |
Windows Registry Modification for Safe Mode Persistence |
production |
2026-05-13 |
| splunk |
Windows Registry Payload Injection |
production |
2026-05-13 |
| splunk |
Windows Registry SIP Provider Modification |
production |
2026-05-13 |
| splunk |
Windows Remote Assistance Spawning Process |
production |
2026-05-13 |
| splunk |
Windows Remote Create Service |
production |
2026-05-13 |
| splunk |
Windows Remote Host Computer Management Access |
production |
2026-05-13 |
| splunk |
Windows Remote Image Load |
production |
2026-05-13 |
| splunk |
Windows Remote Management Execute Shell |
production |
2026-05-13 |