| splunk |
Windows Audit Policy Auditing Option Modified - Registry |
production |
2026-05-13 |
| splunk |
Windows Audit Policy Cleared via Auditpol |
production |
2026-05-13 |
| splunk |
Windows Audit Policy Disabled via Auditpol |
production |
2026-05-13 |
| splunk |
Windows Audit Policy Disabled via Legacy Auditpol |
production |
2026-05-13 |
| splunk |
Windows Audit Policy Excluded Category via Auditpol |
production |
2026-05-13 |
| splunk |
Windows Audit Policy Restored via Auditpol |
production |
2026-05-13 |
| splunk |
Windows Audit Policy Security Descriptor Tampering via Auditpol |
production |
2026-05-13 |
| splunk |
Windows AutoIt3 Execution |
production |
2026-05-13 |
| splunk |
Windows Autostart Execution LSASS Driver Registry Modification |
production |
2026-05-13 |
| splunk |
Windows Azure PowerShell Module Installation Via PowerShell Script |
production |
2026-05-13 |
| splunk |
Windows Azure Storage Utility Execution Via CLI |
production |
2026-05-13 |
| splunk |
Windows Binary Execution from an Archive |
experimental |
2026-05-13 |
| splunk |
Windows Binary Proxy Execution Mavinject DLL Injection |
production |
2026-05-13 |
| splunk |
Windows BitDefender Submission Wizard DLL Sideloading |
experimental |
2026-05-13 |
| splunk |
Windows BitLocker Suspicious Command Usage |
production |
2026-05-13 |
| splunk |
Windows BitLockerToGo Process Execution |
production |
2026-05-13 |
| splunk |
Windows BitLockerToGo with Network Activity |
production |
2026-05-13 |
| splunk |
Windows Bluetooth Service Installed From Uncommon Location |
production |
2026-05-13 |
| splunk |
Windows BootLoader Inventory |
experimental |
2026-05-13 |
| splunk |
Windows Bypass UAC via Pkgmgr Tool |
production |
2026-05-13 |
| splunk |
Windows Cabinet File Extraction Via Expand |
production |
2026-05-13 |
| splunk |
Windows Cached Domain Credentials Reg Query |
production |
2026-05-13 |
| splunk |
Windows Certutil Root Certificate Addition |
production |
2026-05-13 |
| splunk |
Windows Change File Association Command To Notepad |
production |
2026-05-13 |
| splunk |
Windows Chrome Auto-Update Disabled via Registry |
production |
2026-05-13 |
| splunk |
Windows Chrome Enable Extension Loading via Command-Line |
production |
2026-05-13 |
| splunk |
Windows Chrome Extension Allowed Registry Modification |
production |
2026-05-13 |
| splunk |
Windows Chromium Browser Launched with Small Window Size |
production |
2026-05-13 |
| splunk |
Windows Chromium process Launched with Disable Popup Blocking |
production |
2026-05-13 |
| splunk |
Windows Chromium Process Launched with Logging Disabled |
production |
2026-05-13 |
| splunk |
Windows Chromium Process Loaded Extension via Command-Line |
production |
2026-05-13 |
| splunk |
Windows Chromium Process with Disabled Extensions |
production |
2026-05-13 |
| splunk |
Windows Cisco Secure Endpoint Related Service Stopped |
production |
2026-05-13 |
| splunk |
Windows Cisco Secure Endpoint Stop Immunet Service Via Sfc |
production |
2026-05-13 |
| splunk |
Windows Cisco Secure Endpoint Unblock File Via Sfc |
production |
2026-05-13 |
| splunk |
Windows Cisco Secure Endpoint Uninstall Immunet Service Via Sfc |
production |
2026-05-13 |
| splunk |
Windows Cmdline Tool Execution From Non-Shell Process |
production |
2026-05-13 |
| splunk |
Windows Cobalt Strike PowerShell Loader |
production |
2026-05-13 |
| splunk |
Windows COM Hijacking InprocServer32 Modification |
production |
2026-05-13 |
| splunk |
Windows Command and Scripting Interpreter Hunting Path Traversal |
production |
2026-05-13 |