| splunk |
Get DomainPolicy with Powershell Script Block |
production |
2026-05-13 |
| splunk |
Get DomainPolicy with Powershell |
production |
2026-05-13 |
| splunk |
Get ADUserResultantPasswordPolicy with Powershell Script Block |
production |
2026-05-13 |
| splunk |
Get ADUserResultantPasswordPolicy with Powershell |
production |
2026-05-13 |
| splunk |
Get ADUser with PowerShell Script Block |
production |
2026-05-13 |
| splunk |
Get ADUser with PowerShell |
production |
2026-05-13 |
| splunk |
Get ADDefaultDomainPasswordPolicy with Powershell Script Block |
production |
2026-05-13 |
| splunk |
Get ADDefaultDomainPasswordPolicy with Powershell |
production |
2026-05-13 |
| splunk |
Fsutil Zeroing File |
production |
2026-05-13 |
| splunk |
FodHelper UAC Bypass |
production |
2026-05-13 |
| splunk |
First Time Seen Running Windows Service |
experimental |
2026-05-13 |
| splunk |
Short Lived Windows Accounts |
production |
2026-05-13 |
| splunk |
File with Samsam Extension |
production |
2026-05-13 |
| splunk |
SilentCleanup UAC Bypass |
production |
2026-05-13 |
| splunk |
Execution of File with Multiple Extensions |
production |
2026-05-13 |
| splunk |
Execute Javascript With Jscript COM CLSID |
production |
2026-05-13 |
| splunk |
Single Letter Process On Endpoint |
production |
2026-05-13 |
| splunk |
SLUI RunAs Elevated |
production |
2026-05-13 |
| splunk |
Detect mshta inline hta execution |
production |
2026-05-13 |
| splunk |
Detect Mimikatz With PowerShell Script Block Logging |
production |
2026-05-13 |
| splunk |
Detect HTML Help Using InfoTech Storage Handlers |
production |
2026-05-13 |
| splunk |
SLUI Spawning a Process |
production |
2026-05-13 |
| splunk |
Detect Exchange Web Shell |
production |
2026-05-13 |
| splunk |
Detect Excessive Account Lockouts From Endpoint |
production |
2026-05-13 |
| splunk |
Detect Empire with PowerShell Script Block Logging |
production |
2026-05-13 |
| splunk |
Detect Copy of ShadowCopy with Script Block Logging |
production |
2026-05-13 |
| splunk |
Detect Computer Changed with Anonymous Account |
production |
2026-05-13 |
| splunk |
Detect Certipy File Modifications |
production |
2026-05-13 |
| splunk |
Detect Certify With PowerShell Script Block Logging |
production |
2026-05-13 |
| splunk |
Detect Certify Command Line Arguments |
production |
2026-05-13 |
| splunk |
Detect Baron Samedit CVE-2021-3156 via OSQuery |
experimental |
2026-05-13 |
| splunk |
Detect Baron Samedit CVE-2021-3156 |
experimental |
2026-05-13 |
| splunk |
Detect AzureHound File Modifications |
production |
2026-05-13 |
| splunk |
Detect AzureHound Command-Line Arguments |
production |
2026-05-13 |
| splunk |
Deleting Shadow Copies |
production |
2026-05-13 |
| splunk |
Delete ShadowCopy With PowerShell |
production |
2026-05-13 |
| splunk |
Curl Execution with Percent Encoded URL |
production |
2026-05-13 |
| splunk |
Spike in File Writes |
experimental |
2026-05-13 |
| splunk |
Detect Baron Samedit CVE-2021-3156 Segfault |
experimental |
2026-05-13 |
| splunk |
CSC Net On The Fly Compilation |
production |
2026-05-13 |