| elastic |
Suspicious Service was Installed in the System |
production |
2026-10-06 |
| elastic |
Svchost spawning Cmd |
production |
2026-09-18 |
| elastic |
Remote Windows Service Installed |
production |
2026-09-18 |
| elastic |
Remotely Started Services via RPC |
production |
2026-09-18 |
| elastic |
Unsigned DLL Loaded by Svchost |
production |
2026-09-18 |
| elastic |
System Shells via Services |
production |
2026-09-18 |
| elastic |
Potential Privilege Escalation via Service ImagePath Modification |
production |
2026-09-18 |
| elastic |
Service Control Spawned via Script Interpreter |
production |
2026-09-18 |
| elastic |
Systemd Service Started by Unusual Parent Process |
production |
2026-09-18 |
| elastic |
Launch Service Creation and Immediate Loading |
production |
2026-09-18 |
| elastic |
Unusual Process For a Windows Host |
production |
2026-09-18 |
| elastic |
Unusual Windows Service |
production |
2026-09-18 |
| elastic |
PsExec Network Connection |
production |
2026-09-18 |
| elastic |
Suspicious Process Execution via Renamed PsExec Executable |
production |
2026-09-18 |
| elastic |
Service Command Lateral Movement |
production |
2026-09-18 |
| sigma |
Psexec Execution |
test |
2023-02-28 |
| sigma |
Possible CVE-2021-1675 Print Spooler Exploitation |
test |
2022-11-15 |
| sigma |
CVE-2021-1675 Print Spooler Exploitation |
test |
2022-10-09 |
| sigma |
CVE-2021-1675 Print Spooler Exploitation IPC Access |
test |
2022-10-05 |
| sentinel |
Dev-0228 File Path Hashes November 2021 (ASIM Version) |
Scheduled |
— |
| sentinel |
Dev-0228 File Path Hashes November 2021 |
Scheduled |
— |