| splunk |
Windows Suspicious C2 Named Pipe |
production |
2026-09-22 |
| splunk |
Windows Suspicious Named Pipe |
production |
2026-09-22 |
| splunk |
Windows PUA Named Pipe |
production |
2026-09-22 |
| splunk |
Windows RMM Named Pipe |
production |
2026-09-22 |
| elastic |
Potential Command and Control via Internet Explorer |
production |
2026-09-18 |
| elastic |
Execution of COM object via Xwizard |
production |
2026-09-18 |
| elastic |
Suspicious Explorer Child Process |
production |
2026-09-18 |
| elastic |
Remote XSL Script Execution via COM |
production |
2026-09-18 |
| elastic |
Incoming DCOM Lateral Movement via MSHTA |
production |
2026-09-18 |
| elastic |
Incoming DCOM Lateral Movement with ShellBrowserWindow or ShellWindows |
production |
2026-09-18 |
| elastic |
Suspicious Image Load (taskschd.dll) from MS Office |
production |
2026-09-18 |
| elastic |
UAC Bypass Attempt with IEditionUpgradeManager Elevated COM Interface |
production |
2026-09-18 |
| elastic |
UAC Bypass Attempt via Elevated COM Internet Explorer Add-On Installer |
production |
2026-09-18 |
| elastic |
UAC Bypass via ICMLuaUtil Elevated COM Interface |
production |
2026-09-18 |
| elastic |
Incoming DCOM Lateral Movement with MMC |
production |
2026-09-18 |
| elastic |
Unix Socket Connection |
production |
2026-09-18 |
| elastic |
Unusual D-Bus Daemon Child Process |
production |
2026-09-18 |
| elastic |
Suspicious Inter-Process Communication via Outlook |
production |
2026-09-18 |
| splunk |
Windows Anonymous Pipe Activity |
production |
2026-05-13 |
| sigma |
Trickbot Malware Activity |
stable |
2021-11-27 |