mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
truptilangalia-crest
38 KiB
38 KiB
| 1 | detection_name | cim_version | supported_tas | tas_with_cim_mapping |
|---|---|---|---|---|
| 2 | abnormally_high_number_of_cloud_security_group_api_calls | 5.0.0 | Splunk_TA_aws-kinesis-firehose | Splunk_TA_citrix-netscaler, Splunk_TA_nix, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, Splunk_TA_ossec, Splunk_TA_juniper, splunk_ta_o365, Splunk_TA_cyberark, Splunk_TA_box, Splunk_TA_cisco-asa, Splunk_TA_infoblox, Splunk_TA_salesforce |
| 3 | cloud_api_calls_from_previously_unseen_user_roles | 5.0.0 | Splunk_TA_aws-kinesis-firehose | Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, splunk_ta_o365, Splunk_TA_box, Splunk_TA_infoblox, Splunk_TA_salesforce |
| 4 | cloud_compute_instance_created_in_previously_unused_region | 5.0.0 | Splunk_TA_aws-kinesis-firehose | Splunk_TA_aws-kinesis-firehose |
| 5 | cloud_provisioning_from_previously_unseen_country | 5.0.0 | Splunk_TA_aws-kinesis-firehose | Splunk_TA_citrix-netscaler, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, Splunk_TA_juniper, splunk_ta_o365, Splunk_TA_cyberark, Splunk_TA_box, Splunk_TA_cisco-asa, Splunk_TA_infoblox, Splunk_TA_salesforce |
| 6 | cloud_compute_instance_created_with_previously_unseen_instance_type | 5.0.0 | Splunk_TA_aws-kinesis-firehose | Splunk_TA_aws-kinesis-firehose |
| 7 | cloud_compute_instance_created_by_previously_unseen_user | 5.0.0 | Splunk_TA_aws-kinesis-firehose | Splunk_TA_aws-kinesis-firehose |
| 8 | cloud_provisioning_from_previously_unseen_region | 5.0.0 | Splunk_TA_aws-kinesis-firehose | Splunk_TA_citrix-netscaler, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, Splunk_TA_juniper, splunk_ta_o365, Splunk_TA_cyberark, Splunk_TA_box, Splunk_TA_cisco-asa, Splunk_TA_infoblox, Splunk_TA_salesforce |
| 9 | abnormally_high_number_of_cloud_infrastructure_api_calls | 5.0.0 | Splunk_TA_aws-kinesis-firehose | Splunk_TA_citrix-netscaler, Splunk_TA_nix, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, Splunk_TA_ossec, Splunk_TA_juniper, splunk_ta_o365, Splunk_TA_cyberark, Splunk_TA_box, Splunk_TA_cisco-asa, Splunk_TA_infoblox, Splunk_TA_salesforce |
| 10 | cloud_compute_instance_created_with_previously_unseen_image | 5.0.0 | Splunk_TA_aws-kinesis-firehose | Splunk_TA_aws-kinesis-firehose |
| 11 | cloud_provisioning_from_previously_unseen_city | 5.0.0 | Splunk_TA_aws-kinesis-firehose | Splunk_TA_citrix-netscaler, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, Splunk_TA_juniper, splunk_ta_o365, Splunk_TA_cyberark, Splunk_TA_box, Splunk_TA_cisco-asa, Splunk_TA_infoblox, Splunk_TA_salesforce |
| 12 | cloud_provisioning_from_previously_unseen_ip_address | 5.0.0 | Splunk_TA_aws-kinesis-firehose | Splunk_TA_citrix-netscaler, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, Splunk_TA_juniper, splunk_ta_o365, Splunk_TA_cyberark, Splunk_TA_box, Splunk_TA_salesforce |
| 13 | cloud_instance_modified_with_previously_unseen_user | 5.0.0 | Splunk_TA_aws-kinesis-firehose | Splunk_TA_citrix-netscaler, Splunk_TA_nix, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_rsa_securid_cas, Splunk_TA_ossec, Splunk_TA_juniper, splunk_ta_o365, Splunk_TA_cyberark, Splunk_TA_box, Splunk_TA_salesforce |
| 14 | linux_setuid_using_chmod_utility | 5.0.0 | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR | |
| 15 | disabling_folderoptions_windows_feature | 5.0.0 | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon | |
| 16 | anomalous_usage_of_7zip | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 17 | enable_rdp_in_other_port_number | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 18 | excessive_number_of_taskhost_processes | 5.0.0 | Splunk_TA_windows | Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR |
| 19 | xsl_script_execution_with_wmic | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 20 | rundll32_control_rundll_world_writable_directory | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 21 | disable_schedule_task | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR |
| 22 | serviceprincipalnames_discovery_with_setspn | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 23 | allow_operation_with_consent_admin | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 24 | windows_service_initiation_on_remote_endpoint | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 25 | spoolsv_writing_a_dll | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR |
| 26 | dsquery_domain_discovery | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR |
| 27 | linux_possible_access_or_modification_of_sshd_config_file | 5.0.0 | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR | |
| 28 | secretdumps_offline_ntds_dumping_tool | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 29 | attacker_tools_on_endpoint | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows |
| 30 | domain_account_discovery_with_net_app | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 31 | certutil_exe_certificate_extraction | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 32 | detect_html_help_url_in_command_line | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 33 | prevent_automatic_repair_mode_using_bcdedit | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 34 | linux_possible_access_to_sudoers_file | 5.0.0 | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR | |
| 35 | get_domainpolicy_with_powershell | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 36 | excessive_number_of_distinct_processes_created_in_windows_temp_folder | 5.0.0 | Splunk_TA_windows | Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR, Splunk_TA_cyberark_epm |
| 37 | disable_registry_tool | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 38 | powershell_disable_security_monitoring | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 39 | svchost_exe_lolbas_execution_process_spawn | 5.0.0 | Splunk_TA_microsoft_sysmon | |
| 40 | disable_defender_spynet_reporting | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 41 | certutil_download_with_verifyctl_and_split_arguments | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 42 | windows_nirsoft_advancedrun | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 43 | cmd_echo_pipe___escalation | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 44 | excessive_number_of_service_control_start_as_disabled | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 45 | windows_installutil_url_in_command_line | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 46 | detect_use_of_cmd_exe_to_launch_script_interpreters | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 47 | suspicious_icedid_rundll32_cmdline | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 48 | excessive_service_stop_attempt | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 49 | suspicious_copy_on_system32 | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 50 | credential_dumping_via_symlink_to_shadow_copy | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 51 | suspicious_searchprotocolhost_no_command_line_arguments | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 52 | excessive_usage_of_net_app | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 53 | permission_modification_using_takeown_app | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 54 | linux_at_application_execution | 5.0.0 | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR | |
| 55 | reg_exe_manipulating_windows_services_registry_keys | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR |
| 56 | logon_script_event_trigger_execution | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 57 | linux_possible_ssh_key_file_creation | 5.0.0 | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon | |
| 58 | dump_lsass_via_procdump | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR |
| 59 | getwmiobject_ds_computer_with_powershell | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 60 | sdclt_uac_bypass | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 61 | hide_user_account_from_sign_in_screen | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 62 | deleting_of_net_users | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 63 | revil_registry_entry | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 64 | detect_psexec_with_accepteula_flag | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 65 | remote_process_instantiation_via_dcom_and_powershell | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 66 | auto_admin_logon_registry_entry | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 67 | linux_doas_tool_execution | 5.0.0 | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR | |
| 68 | modify_acl_permission_to_files_or_folder | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR |
| 69 | getdomaingroup_with_powershell | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 70 | disable_amsi_through_registry | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 71 | wermgr_process_spawned_cmd_or_powershell_process | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 72 | detect_azurehound_command_line_arguments | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 73 | office_product_spawning_rundll32_with_no_dll | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 74 | detect_exchange_web_shell | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR |
| 75 | time_provider_persistence_registry | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 76 | system_processes_run_from_unexpected_locations | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR |
| 77 | scheduled_task_initiation_on_remote_endpoint | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 78 | sc_exe_manipulating_windows_services | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR |
| 79 | disable_defender_submit_samples_consent_feature | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 80 | ryuk_wake_on_lan_command | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 81 | suspicious_msbuild_spawn | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 82 | linux_possible_access_to_credential_files | 5.0.0 | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR | |
| 83 | suspicious_wevtutil_usage | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR |
| 84 | excessive_usage_of_cacls_app | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR |
| 85 | disabling_task_manager | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 86 | office_document_spawned_child_process_to_download | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 87 | processes_launching_netsh | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 88 | linux_possible_append_command_to_at_allow_config_file | 5.0.0 | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR | |
| 89 | single_letter_process_on_endpoint | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR, Splunk_TA_cyberark_epm |
| 90 | check_elevated_cmd_using_whoami | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 91 | short_lived_windows_accounts | 5.0.0 | Splunk_TA_microsoft-cloudservices, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose, Splunk_TA_cyberark | |
| 92 | possible_lateral_movement_powershell_spawn | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 93 | schtasks_scheduling_job_on_remote_system | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR |
| 94 | executables_or_script_creation_in_suspicious_path | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR |
| 95 | active_setup_registry_autostart | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 96 | suspicious_rundll32_with_no_command_line_arguments | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 97 | winword_spawning_powershell | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 98 | suspicious_regsvr32_register_suspicious_path | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 99 | linux_install_kernel_module_using_modprobe_utility | 5.0.0 | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR | |
| 100 | scheduled_task_creation_on_remote_endpoint_using_at | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 101 | linux_possible_append_command_to_profile_config_file | 5.0.0 | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR | |
| 102 | nishang_powershelltcponeline | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 103 | detect_mshta_url_in_command_line | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 104 | linux_sudoers_tmp_file_creation | 5.0.0 | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon | |
| 105 | linux_service_restarted | 5.0.0 | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR | |
| 106 | disabling_defender_services | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 107 | getwmiobject_ds_group_with_powershell | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 108 | firewall_allowed_program_enable | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 109 | office_application_spawn_regsvr32_process | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 110 | detect_rundll32_inline_hta_execution | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 111 | suspicious_gpupdate_no_command_line_arguments | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 112 | extraction_of_registry_hives | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 113 | powershell_start_bitstransfer | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 114 | suspicious_mshta_spawn | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 115 | detect_rundll32_application_control_bypass___setupapi | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 116 | recursive_delete_of_directory_in_batch_cmd | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 117 | get_aduserresultantpasswordpolicy_with_powershell | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 118 | windows_dotnet_binary_in_non_standard_path | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 119 | net_profiler_uac_bypass | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 120 | disable_etw_through_registry | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 121 | remote_process_instantiation_via_winrm_and_winrs | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 122 | office_product_spawning_wmic | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 123 | execution_of_file_with_multiple_extensions | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows |
| 124 | remote_process_instantiation_via_winrm_and_powershell | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 125 | suspicious_process_file_path | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 126 | any_powershell_downloadstring | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 127 | linux_change_file_owner_to_root | 5.0.0 | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR | |
| 128 | process_creating_lnk_file_in_suspicious_location | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR |
| 129 | wbadmin_delete_system_backups | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR |
| 130 | linux_pkexec_privilege_escalation | 5.0.0 | Splunk_TA_microsoft_sysmon | |
| 131 | disabling_controlpanel | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 132 | attempt_to_stop_security_service | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 133 | excel_spawning_powershell | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 134 | allow_inbound_traffic_by_firewall_rule_registry | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 135 | getdomaincomputer_with_powershell | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 136 | malicious_powershell_process___execution_policy_bypass | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 137 | disable_defender_enhanced_notification | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 138 | fodhelper_uac_bypass | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 139 | detect_regsvr32_application_control_bypass | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 140 | windows_curl_download_to_suspicious_path | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 141 | remcos_client_registry_install_entry | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 142 | suspicious_microsoft_workflow_compiler_usage | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 143 | bcdedit_failure_recovery_modification | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR |
| 144 | linux_service_file_created_in_systemd_directory | 5.0.0 | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon | |
| 145 | slui_runas_elevated | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 146 | batch_file_write_to_system32 | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR |
| 147 | windows_dism_remove_defender | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 148 | excessive_usage_of_taskkill | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR |
| 149 | nltest_domain_trust_discovery | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 150 | fsutil_zeroing_file | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 151 | office_application_spawn_rundll32_process | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 152 | add_or_set_windows_defender_exclusion | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 153 | bitsadmin_download_file | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 154 | print_processor_registry_autostart | 5.0.0 | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon | |
| 155 | detect_path_interception_by_creation_of_program_exe | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 156 | cmdline_tool_not_executed_in_cmd_shell | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 157 | detect_mshta_inline_hta_execution | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 158 | suspicious_rundll32_startw | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 159 | script_execution_via_wmi | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR, Splunk_TA_cyberark_epm |
| 160 | slui_spawning_a_process | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 161 | scheduled_task_deleted_or_created_via_cmd | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 162 | allow_network_discovery_in_firewall | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 163 | linux_file_created_in_kernel_driver_directory | 5.0.0 | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon | |
| 164 | disable_logs_using_wevtutil | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 165 | revil_common_exec_parameter | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 166 | detect_sharphound_usage | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 167 | wmiprsve_exe_lolbas_execution_process_spawn | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 168 | linux_file_creation_in_profile_directory | 5.0.0 | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon | |
| 169 | services_exe_lolbas_execution_process_spawn | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 170 | regsvr32_with_known_silent_switch_cmdline | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 171 | windows_installutil_uninstall_option | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 172 | deleting_shadow_copies | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 173 | winhlp32_spawning_a_process | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 174 | disabling_firewall_with_netsh | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 175 | elevated_group_discovery_with_net | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 176 | linux_setuid_using_setcap_utility | 5.0.0 | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR | |
| 177 | linux_preload_hijack_library_calls | 5.0.0 | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR | |
| 178 | windows_installutil_in_non_standard_path | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 179 | get_foresttrust_with_powershell | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 180 | windows_defender_exclusion_registry_entry | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 181 | windows_adfind_exe | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 182 | disabling_cmd_application | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 183 | msmpeng_application_dll_side_loading | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR |
| 184 | account_discovery_with_net_app | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 185 | linux_insert_kernel_module_using_insmod_utility | 5.0.0 | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR | |
| 186 | certutil_download_with_urlcache_and_split_arguments | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 187 | suspicious_msbuild_rename | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 188 | suspicious_mshta_child_process | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 189 | set_default_powershell_execution_policy_to_unrestricted_or_bypass | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 190 | uninstall_app_using_msiexec | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 191 | execute_javascript_with_jscript_com_clsid | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 192 | create_local_admin_accounts_using_net_exe | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 193 | disable_uac_remote_restriction | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 194 | linux_doas_conf_file_creation | 5.0.0 | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon | |
| 195 | creation_of_shadow_copy | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 196 | linux_file_creation_in_init_boot_directory | 5.0.0 | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon | |
| 197 | windows_disableantispyware_reg | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 198 | disable_defender_mpengine_registry | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 199 | getwmiobject_ds_user_with_powershell | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 200 | disable_windows_app_hotkeys | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 201 | dns_exfiltration_using_nslookup_app | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 202 | clear_unallocated_sector_using_cipher_app | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 203 | linux_java_spawning_shell | 5.0.0 | Splunk_TA_microsoft_sysmon | |
| 204 | disable_defender_blockatfirstseen_feature | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 205 | remote_process_instantiation_via_wmi_and_powershell | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 206 | detect_regsvcs_with_no_command_line_arguments | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 207 | get_domaintrust_with_powershell | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 208 | windows_installutil_credential_theft | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 209 | elevated_group_discovery_with_wmic | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 210 | registry_keys_used_for_persistence | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 211 | detect_rundll32_application_control_bypass___syssetup | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 212 | ping_sleep_batch_command | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 213 | detect_processes_used_for_system_network_configuration_discovery | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 214 | clop_common_exec_parameter | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 215 | office_product_spawning_certutil | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 216 | regsvr32_silent_and_install_param_dll_loading | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 217 | msbuild_suspicious_spawned_by_script_process | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 218 | hiding_files_and_directories_with_attrib_exe | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows |
| 219 | office_product_spawn_cmd_process | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 220 | wsreset_uac_bypass | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 221 | certutil_with_decode_argument | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 222 | allow_file_and_printing_sharing_in_firewall | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 223 | system_information_discovery_detection | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR, Splunk_TA_cyberark_epm |
| 224 | malicious_powershell_process_with_obfuscation_techniques | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 225 | linux_add_files_in_known_crontab_directories | 5.0.0 | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon | |
| 226 | eventvwr_uac_bypass | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 227 | icacls_deny_command | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR |
| 228 | usn_journal_deletion | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 229 | remote_system_discovery_with_wmic | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 230 | detect_html_help_using_infotech_storage_handlers | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 231 | disable_security_logs_using_minint_registry | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 232 | sdelete_application_execution | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 233 | curl_download_and_bash_execution | 5.0.0 | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon | |
| 234 | icacls_grant_command | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR |
| 235 | winword_spawning_cmd | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 236 | credential_dumping_via_copy_command_from_shadow_copy | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 237 | detect_regasm_with_no_command_line_arguments | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 238 | enable_wdigest_uselogoncredential_registry | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 239 | control_loading_from_world_writable_directory | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 240 | remote_process_instantiation_via_wmi | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 241 | suspicious_dllhost_no_command_line_arguments | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 242 | spoolsv_spawning_rundll32 | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 243 | conti_common_exec_parameter | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 244 | attempted_credential_dump_from_registry_via_reg_exe | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 245 | jscript_execution_using_cscript_app | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 246 | bcdedit_command_back_to_normal_mode_boot | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 247 | rundll32_shimcache_flush | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 248 | screensaver_event_trigger_execution | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 249 | office_product_spawning_bitsadmin | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 250 | change_default_file_association | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 251 | wscript_or_cscript_suspicious_child_process | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 252 | domain_controller_discovery_with_nltest | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 253 | disable_windows_behavior_monitoring | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 254 | windows_curl_upload_to_remote_destination | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 255 | unified_messaging_service_spawning_a_process | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 256 | detect_html_help_spawn_child_process | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 257 | detect_regsvcs_spawning_a_process | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 258 | linux_service_started_or_enabled | 5.0.0 | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR | |
| 259 | java_class_file_download_by_java_user_agent | 5.0.0 | Splunk_TA_citrix-netscaler, Splunk_TA_nginx, Splunk_TA_microsoft-iis, Splunk_TA_websense-cg, Splunk_TA_squid, Splunk_TA_haproxy, Splunk_TA_mcafee-wg, Splunk_TA_cisco-wsa | |
| 260 | linux_at_allow_config_file_creation | 5.0.0 | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon | |
| 261 | disable_defender_antivirus_registry | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 262 | linux_visudo_utility_execution | 5.0.0 | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR | |
| 263 | schtasks_run_task_on_demand | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR |
| 264 | schtasks_used_for_forcing_a_reboot | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR |
| 265 | windows_raccine_scheduled_task_deletion | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 266 | mshta_spawning_rundll32_or_regsvr32_process | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 267 | excessive_attempt_to_disable_services | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR |
| 268 | get_domainuser_with_powershell | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 269 | suspicious_scheduled_task_from_public_directory | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 270 | rundll32_with_no_command_line_arguments_with_network | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 271 | windows_service_creation_on_remote_endpoint | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 272 | linux_nopasswd_entry_in_sudoers_file | 5.0.0 | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR | |
| 273 | attempt_to_add_certificate_to_untrusted_store | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 274 | process_kill_base_on_file_path | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 275 | wsmprovhost_exe_lolbas_execution_process_spawn | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 276 | domain_account_discovery_with_wmic | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 277 | disabling_norun_windows_app | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 278 | suspicious_rundll32_plugininit | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 279 | file_with_samsam_extension | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, splunk_ta_o365, Splunk_TA_sophos, Splunk_TA_cyberark, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR |
| 280 | silentcleanup_uac_bypass | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 281 | ntdsutil_export_ntds | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 282 | disabling_systemrestore_in_registry | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 283 | vbscript_execution_using_wscript_app | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 284 | office_spawning_control | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 285 | detect_regasm_spawning_a_process | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 286 | start_up_during_safe_mode_boot | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 287 | office_product_spawning_mshta | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 288 | change_to_safe_mode_with_network_config | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 289 | potentially_malicious_code_on_commandline | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 290 | detect_rundll32_application_control_bypass___advpack | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 291 | services_escalate_exe | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 292 | wget_download_and_bash_execution | 5.0.0 | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon | |
| 293 | remote_wmi_command_attempt | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 294 | create_or_delete_windows_shares_using_net_exe | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 295 | unload_sysmon_filter_driver | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR |
| 296 | resize_shadowstorage_volume | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 297 | wmic_xsl_execution_via_url | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 298 | suspicious_reg_exe_process | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR |
| 299 | etw_registry_disabled | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 300 | process_execution_via_wmi | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR |
| 301 | samsam_test_file_write | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_nix, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, splunk_ta_o365, Splunk_TA_sophos, Splunk_TA_cyberark, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR |
| 302 | impacket_lateral_movement_commandline_parameters | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 303 | dump_lsass_via_comsvcs_dll | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 304 | creation_of_shadow_copy_with_wmic_and_powershell | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 305 | overwriting_accessibility_binaries | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_nix, Splunk_TA_ossec, Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, splunk_ta_o365, Splunk_TA_sophos, Splunk_TA_cyberark, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR |
| 306 | add_defaultuser_and_password_in_registry | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 307 | bits_job_persistence | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 308 | suspicious_rundll32_dllregisterserver | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 309 | any_powershell_downloadfile | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 310 | mmc_exe_lolbas_execution_process_spawn | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 311 | w3wp_spawning_shell | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 312 | detect_sharphound_command_line_arguments | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon |
| 313 | detect_rclone_command_line_usage | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 314 | suspicious_msbuild_path | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 315 | disabling_net_user_account | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 316 | shim_database_installation_with_suspicious_parameters | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_bit9-carbonblack, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR |
| 317 | dns_query_length_with_high_standard_deviation | 5.0.0 | Splunk_TA_microsoft_sysmon | Splunk_TA_isc-bind, Splunk_TA_microsoft_sysmon, Splunk_TA_CrowdStrike_FDR, Splunk_TA_infoblox |