| splunk |
Windows Access Token Manipulation SeDebugPrivilege |
production |
2026-10-09 |
| elastic |
Process Creation via Secondary Logon |
production |
2026-10-08 |
| elastic |
Process Created with a Duplicated Token |
production |
2026-09-18 |
| elastic |
Interactive Logon by an Unusual Process |
production |
2026-09-18 |
| elastic |
PowerShell Script with Token Impersonation Capabilities |
production |
2026-09-18 |
| elastic |
Privileges Elevation via Parent Process PID Spoofing |
production |
2026-09-18 |
| elastic |
Process Created with an Elevated Token |
production |
2026-09-18 |
| sigma |
RedSun - Conhost.exe Spawned by TieringEngineService.exe |
experimental |
2026-04-17 |
| sigma |
Suspicious Child Process Created as System |
test |
2024-12-01 |
| sigma |
Meterpreter or Cobalt Strike Getsystem Service Installation - System |
test |
2023-11-15 |
| sigma |
Meterpreter or Cobalt Strike Getsystem Service Installation - Security |
test |
2023-11-15 |
| sigma |
PUA - AdvancedRun Execution |
test |
2023-02-21 |
| sigma |
PUA - AdvancedRun Suspicious Execution |
test |
2023-02-21 |
| sigma |
Potential Meterpreter/CobaltStrike Activity |
test |
2023-02-05 |