| splunk |
Detection of tools built by NirSoft |
deprecated |
2026-10-01 |
| elastic |
Potential WSUS Abuse for Lateral Movement |
production |
2026-09-18 |
| elastic |
Suspicious Curl to Jamf Endpoint |
production |
2026-09-18 |
| elastic |
Tool Installation Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
New GitHub App Installed |
production |
2026-09-18 |
| splunk |
Microsoft Intune DeviceManagementConfigurationPolicies |
production |
2026-05-13 |
| splunk |
Microsoft Intune Manual Device Management |
production |
2026-05-13 |
| splunk |
Microsoft Intune Mobile Apps |
experimental |
2026-05-13 |
| splunk |
Microsoft Intune Device Health Scripts |
production |
2026-05-13 |
| suricata |
ET HUNTING VibeCoded MSI Installer VBS Script Inbound |
rev 1 |
2026-03-24 |
| snort |
ET INFO VibeCoded MSI Installer VBS Script Inbound |
rev 1 |
2026-03-24 |
| sigma |
PUA - Radmin Viewer Utility Execution |
test |
2023-12-11 |
| sigma |
PDQ Deploy Remote Adminstartion Tool Execution |
test |
2023-01-30 |
| sigma |
Restricted Software Access By SRP |
test |
2023-01-12 |
| sigma |
Suspicious Csi.exe Usage |
test |
2022-07-11 |
| sentinel |
New EXE deployed via Default Domain or Default Domain Controller Policies (ASIM Version) |
Scheduled |
— |