| splunk |
Hiding Files And Directories With Attrib exe |
production |
2026-10-09 |
| splunk |
Windows SubInAcl Execution |
production |
2026-10-02 |
| splunk |
Windows Files and Dirs Access Rights Modification Via Icacls |
production |
2026-10-02 |
| splunk |
Windows AD Dangerous Deny ACL Modification |
production |
2026-09-22 |
| splunk |
Windows AD Dangerous Group ACL Modification |
production |
2026-09-22 |
| splunk |
Windows AD Dangerous User ACL Modification |
production |
2026-09-22 |
| splunk |
Windows AD DCShadow Privileges ACL Addition |
production |
2026-09-22 |
| splunk |
Windows AD Domain Root ACL Deletion |
production |
2026-09-22 |
| splunk |
Windows AD Domain Root ACL Modification |
production |
2026-09-22 |
| splunk |
Windows AD GPO New CSE Addition |
production |
2026-09-22 |
| splunk |
Windows AD Hidden OU Creation |
production |
2026-09-22 |
| splunk |
Windows AD Object Owner Updated |
production |
2026-09-22 |
| elastic |
Adding Hidden File Attribute via Attrib |
production |
2026-09-18 |
| elastic |
System File Ownership Change |
production |
2026-09-18 |
| splunk |
Windows File and Directory Enable ReadOnly Permissions |
production |
2026-05-13 |
| splunk |
Windows AD Suspicious Attribute Modification |
production |
2026-05-13 |
| splunk |
Windows File and Directory Permissions Enable Inheritance |
production |
2026-05-13 |
| splunk |
Windows File and Directory Permissions Remove Inheritance |
production |
2026-05-13 |
| splunk |
Windows Symlink Evaluation Change via Fsutil |
production |
2026-05-13 |
| sigma |
Potentially Suspicious NTFS Symlink Behavior Modification |
test |
2025-11-13 |
| sigma |
WannaCry Ransomware Activity |
test |
2025-10-18 |
| sigma |
File or Folder Permissions Modifications |
test |
2023-11-21 |
| sigma |
Suspicious Recursive Takeown |
test |
2022-11-21 |
| sigma |
AD Object WriteDAC Access |
test |
2021-11-27 |