| splunk |
Network Share Discovery Via Dir Command |
production |
2026-10-02 |
| splunk |
Windows Network Share Interaction Via Net |
production |
2026-10-02 |
| splunk |
Windows File Share Discovery With Powerview |
production |
2026-10-02 |
| splunk |
MacOS Network Share Discovery |
production |
2026-10-02 |
| elastic |
PowerShell Share Enumeration Script |
production |
2026-09-18 |
| elastic |
PowerShell Suspicious Discovery Related Windows API Functions |
production |
2026-09-18 |
| elastic |
Manual Mount Discovery via /etc/exports or /etc/fstab |
production |
2026-09-18 |
| splunk |
Windows Large Number of Computer Service Tickets Requested |
production |
2026-07-05 |
| splunk |
Windows Administrative Shares Accessed On Multiple Hosts |
production |
2026-05-13 |
| splunk |
Windows Special Privileged Logon On Multiple Hosts |
production |
2026-05-13 |
| splunk |
Advanced IP or Port Scanner Execution |
production |
2026-05-13 |
| sigma |
File Explorer Folder Opened Using Explorer Folder Shortcut Via Shell |
test |
2024-08-23 |
| sigma |
HackTool - SharpView Execution |
test |
2023-02-14 |
| sigma |
PUA - Advanced Port Scanner Execution |
test |
2023-02-07 |
| sigma |
PUA - Advanced IP Scanner Execution |
test |
2023-02-07 |
| sigma |
Potential Dridex Activity |
stable |
2023-02-03 |
| sigma |
Turla Group Lateral Movement |
test |
2022-10-09 |
| sigma |
Net.EXE Execution |
test |
2022-07-11 |