| elastic |
UAC Bypass via ICMLuaUtil Elevated COM Interface |
production |
2026-09-18 |
| elastic |
Incoming DCOM Lateral Movement with MMC |
production |
2026-09-18 |
| elastic |
Incoming DCOM Lateral Movement with ShellBrowserWindow or ShellWindows |
production |
2026-09-18 |
| elastic |
Suspicious Image Load (taskschd.dll) from MS Office |
production |
2026-09-18 |
| elastic |
UAC Bypass Attempt with IEditionUpgradeManager Elevated COM Interface |
production |
2026-09-18 |
| elastic |
UAC Bypass Attempt via Elevated COM Internet Explorer Add-On Installer |
production |
2026-09-18 |
| elastic |
Suspicious Inter-Process Communication via Outlook |
production |
2026-09-18 |
| elastic |
Potential Command and Control via Internet Explorer |
production |
2026-09-18 |
| elastic |
Execution of COM object via Xwizard |
production |
2026-09-18 |
| elastic |
Suspicious Explorer Child Process |
production |
2026-09-18 |
| elastic |
Remote XSL Script Execution via COM |
production |
2026-09-18 |
| elastic |
Incoming DCOM Lateral Movement via MSHTA |
production |
2026-09-18 |
| splunk |
Process Writing DynamicWrapperX |
production |
2026-05-13 |
| sigma |
Dllhost.EXE Initiated Network Connection To Non-Local IP Address |
test |
2024-07-16 |
| sigma |
Network Connection Initiated By Regsvr32.EXE |
test |
2023-09-18 |
| sigma |
DNS Query Request By Regsvr32.EXE |
test |
2023-09-18 |
| sigma |
CMSTP Execution Process Access |
stable |
2021-06-27 |