| splunk |
ESXi Syslog Config Change |
production |
2026-05-13 |
| splunk |
Detect Outbound SMB Traffic |
production |
2026-05-13 |
| splunk |
Detect Port Security Violation |
experimental |
2026-05-13 |
| splunk |
Detect Rogue DHCP Server |
experimental |
2026-05-13 |
| splunk |
Detect SNICat SNI Exfiltration |
experimental |
2026-05-13 |
| splunk |
Detect Software Download To Network Device |
experimental |
2026-05-13 |
| splunk |
Detect Traffic Mirroring |
experimental |
2026-05-13 |
| splunk |
Detect Unauthorized Assets by MAC address |
experimental |
2026-05-13 |
| splunk |
Detect Windows DNS SIGRed via Splunk Stream |
experimental |
2026-05-13 |
| splunk |
Detect attackers scanning for vulnerable JBoss servers |
experimental |
2026-05-13 |
| splunk |
Detect malicious requests to exploit JBoss servers |
experimental |
2026-05-13 |
| splunk |
Detect Web Access to Decommissioned S3 Bucket |
experimental |
2026-05-13 |
| splunk |
Exploit Public Facing Application via Apache Commons Text |
production |
2026-05-13 |
| splunk |
Exploit Public-Facing Fortinet FortiNAC CVE-2022-39952 |
production |
2026-05-13 |
| splunk |
F5 TMUI Authentication Bypass |
production |
2026-05-13 |
| splunk |
Fortinet Appliance Auth bypass |
production |
2026-05-13 |
| splunk |
High Volume of Bytes Out to Url |
production |
2026-05-13 |
| splunk |
HTTP Duplicated Header |
production |
2026-05-13 |
| splunk |
HTTP Possible Request Smuggling |
production |
2026-05-13 |
| splunk |
Windows Unusual NTLM Authentication Destinations By Source |
production |
2026-05-13 |
| splunk |
Hunting for Log4Shell |
production |
2026-05-13 |
| splunk |
Ivanti Connect Secure Command Injection Attempts |
production |
2026-05-13 |
| splunk |
Ivanti Connect Secure SSRF in SAML Component |
production |
2026-05-13 |
| splunk |
Ivanti Connect Secure System Information Access via Auth Bypass |
production |
2026-05-13 |
| splunk |
Ivanti EPM SQL Injection Remote Code Execution |
production |
2026-05-13 |
| splunk |
Ivanti EPMM Remote Unauthenticated API Access CVE-2023-35078 |
production |
2026-05-13 |
| splunk |
Ivanti EPMM Remote Unauthenticated API Access CVE-2023-35082 |
production |
2026-05-13 |
| splunk |
Java Class File download by Java User Agent |
production |
2026-05-13 |
| splunk |
Jenkins Arbitrary File Read CVE-2024-23897 |
production |
2026-05-13 |
| splunk |
JetBrains TeamCity Authentication Bypass CVE-2024-27198 |
production |
2026-05-13 |
| splunk |
JetBrains TeamCity Authentication Bypass Suricata CVE-2024-27198 |
production |
2026-05-13 |
| splunk |
JetBrains TeamCity Limited Auth Bypass Suricata CVE-2024-27199 |
production |
2026-05-13 |
| splunk |
JetBrains TeamCity RCE Attempt |
production |
2026-05-13 |
| splunk |
Juniper Networks Remote Code Execution Exploit Detection |
production |
2026-05-13 |
| splunk |
Windows Universal Data Link File Creation |
production |
2026-05-13 |
| splunk |
Monitor Web Traffic For Brand Abuse |
experimental |
2026-05-13 |
| splunk |
Multiple Archive Files Http Post Traffic |
production |
2026-05-13 |
| splunk |
PaperCut NG Remote Web Access Attempt |
production |
2026-05-13 |
| splunk |
ProxyShell ProxyNotShell Behavior Detected |
production |
2026-05-13 |
| splunk |
SAP NetWeaver Visual Composer Exploitation Attempt |
production |
2026-05-13 |