| splunk |
Windows System Time Discovery W32tm Delay |
production |
2026-05-13 |
| splunk |
Windows System User Discovery Via Quser |
production |
2026-05-13 |
| splunk |
Windows System User Privilege Discovery |
production |
2026-05-13 |
| splunk |
Windows TeamCity Payload Execution from Temp Directory |
production |
2026-05-13 |
| splunk |
Windows TeamCity Plugin Installed |
production |
2026-05-13 |
| splunk |
Windows WMI Process And Service List |
production |
2026-05-13 |
| splunk |
Windows WMI Process Call Create |
production |
2026-05-13 |
| splunk |
Windows WMI Reconnaissance Class Query |
production |
2026-05-13 |
| splunk |
Windows Wmic CPU Discovery |
production |
2026-05-13 |
| splunk |
Windows Wmic DiskDrive Discovery |
production |
2026-05-13 |
| splunk |
Windows Wmic Memory Chip Discovery |
production |
2026-05-13 |
| splunk |
Windows Wmic Network Discovery |
production |
2026-05-13 |
| splunk |
Windows WMIC Shadowcopy Delete |
production |
2026-05-13 |
| splunk |
Windows Wmic Systeminfo Discovery |
production |
2026-05-13 |
| splunk |
Windows WPDBusEnum Registry Key Modification |
production |
2026-05-13 |
| splunk |
Windows WSUS Spawning Shell |
production |
2026-05-13 |
| splunk |
Windows XLL File Creation Outside of Typical Location |
production |
2026-05-13 |
| splunk |
WinEvent Scheduled Task Created to Spawn Shell |
production |
2026-05-13 |
| splunk |
WinEvent Scheduled Task Created Within Public Path |
production |
2026-05-13 |
| splunk |
WinEvent Windows Task Scheduler Event Action Started |
production |
2026-05-13 |
| splunk |
Winhlp32 Spawning a Process |
production |
2026-05-13 |
| splunk |
WinRAR Spawning Shell Application |
production |
2026-05-13 |
| splunk |
WinRM Spawning a Process |
experimental |
2026-05-13 |
| splunk |
WMI Recon Running Process Or Services |
production |
2026-05-13 |
| splunk |
Wmic Group Discovery |
production |
2026-05-13 |
| splunk |
Wmic NonInteractive App Uninstallation |
production |
2026-05-13 |
| splunk |
Wmiprvse LOLBAS Execution Process Spawn |
production |
2026-05-13 |
| splunk |
Wsmprovhost LOLBAS Execution Process Spawn |
production |
2026-05-13 |
| splunk |
WSReset UAC Bypass |
production |
2026-05-13 |
| splunk |
XSL Script Execution With WMIC |
production |
2026-05-13 |
| splunk |
Cisco Configuration Archive Logging Analysis |
production |
2026-05-13 |
| splunk |
Cisco IOS Suspicious Privileged Account Creation |
production |
2026-05-13 |
| splunk |
Cisco Network Interface Modifications |
production |
2026-05-13 |
| splunk |
Cisco Privileged Account Creation with HTTP Command Execution |
production |
2026-05-13 |
| splunk |
Cisco Privileged Account Creation with Suspicious SSH Activity |
production |
2026-05-13 |
| sigma |
Cmd.EXE Missing Space Characters Execution Anomaly |
test |
2026-05-13 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.sanibelislandfloridarealestate .com domain |
rev 1 |
2026-05-12 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.sanibelislandfloridarealestate .com domain |
rev 1 |
2026-05-12 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.sanibelislandfloridarealestate .com domain |
rev 1 |
2026-05-12 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.sanibelislandfloridarealestate .com domain |
rev 1 |
2026-05-12 |