mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
root
47 KiB
47 KiB
| 1 | detection_name | cim_version | supported_tas | tas_with_cim_mapping |
|---|---|---|---|---|
| 2 | cloud_compute_instance_created_in_previously_unused_region | 5.0.1 | Splunk_TA_aws-kinesis-firehose | Splunk_TA_aws-kinesis-firehose |
| 3 | abnormally_high_number_of_cloud_security_group_api_calls | 5.0.1 | Splunk_TA_aws-kinesis-firehose | Splunk_TA_juniper, Splunk_TA_ossec, Splunk_TA_citrix-netscaler, Splunk_TA_nix, Splunk_TA_cyberark, Splunk_TA_salesforce, Splunk_TA_rsa_securid_cas, Splunk_TA_box, splunk_ta_o365, Splunk_TA_rsa-securid, Splunk_TA_cisco-asa, Splunk_TA_aws-kinesis-firehose, Splunk_TA_infoblox |
| 4 | abnormally_high_number_of_cloud_infrastructure_api_calls | 5.0.1 | Splunk_TA_aws-kinesis-firehose | Splunk_TA_juniper, Splunk_TA_ossec, Splunk_TA_citrix-netscaler, Splunk_TA_nix, Splunk_TA_cyberark, Splunk_TA_salesforce, Splunk_TA_rsa_securid_cas, Splunk_TA_box, splunk_ta_o365, Splunk_TA_rsa-securid, Splunk_TA_cisco-asa, Splunk_TA_aws-kinesis-firehose, Splunk_TA_infoblox |
| 5 | cloud_provisioning_from_previously_unseen_region | 5.0.1 | Splunk_TA_aws-kinesis-firehose | Splunk_TA_juniper, Splunk_TA_citrix-netscaler, Splunk_TA_cyberark, Splunk_TA_salesforce, Splunk_TA_rsa_securid_cas, Splunk_TA_box, splunk_ta_o365, Splunk_TA_rsa-securid, Splunk_TA_cisco-asa, Splunk_TA_aws-kinesis-firehose, Splunk_TA_infoblox |
| 6 | cloud_provisioning_from_previously_unseen_city | 5.0.1 | Splunk_TA_aws-kinesis-firehose | Splunk_TA_juniper, Splunk_TA_citrix-netscaler, Splunk_TA_cyberark, Splunk_TA_salesforce, Splunk_TA_rsa_securid_cas, Splunk_TA_box, splunk_ta_o365, Splunk_TA_rsa-securid, Splunk_TA_cisco-asa, Splunk_TA_aws-kinesis-firehose, Splunk_TA_infoblox |
| 7 | cloud_provisioning_from_previously_unseen_ip_address | 5.0.1 | Splunk_TA_aws-kinesis-firehose | Splunk_TA_juniper, Splunk_TA_citrix-netscaler, Splunk_TA_cyberark, Splunk_TA_salesforce, Splunk_TA_rsa_securid_cas, Splunk_TA_box, splunk_ta_o365, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose |
| 8 | cloud_instance_modified_with_previously_unseen_user | 5.0.1 | Splunk_TA_aws-kinesis-firehose | Splunk_TA_juniper, Splunk_TA_ossec, Splunk_TA_citrix-netscaler, Splunk_TA_nix, Splunk_TA_cyberark, Splunk_TA_salesforce, Splunk_TA_rsa_securid_cas, Splunk_TA_box, splunk_ta_o365, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose |
| 9 | cloud_compute_instance_created_by_previously_unseen_user | 5.0.1 | Splunk_TA_aws-kinesis-firehose | Splunk_TA_aws-kinesis-firehose |
| 10 | cloud_api_calls_from_previously_unseen_user_roles | 5.0.1 | Splunk_TA_aws-kinesis-firehose | Splunk_TA_salesforce, Splunk_TA_rsa_securid_cas, Splunk_TA_box, splunk_ta_o365, Splunk_TA_aws-kinesis-firehose, Splunk_TA_infoblox |
| 11 | cloud_provisioning_from_previously_unseen_country | 5.0.1 | Splunk_TA_aws-kinesis-firehose | Splunk_TA_juniper, Splunk_TA_citrix-netscaler, Splunk_TA_cyberark, Splunk_TA_salesforce, Splunk_TA_rsa_securid_cas, Splunk_TA_box, splunk_ta_o365, Splunk_TA_rsa-securid, Splunk_TA_cisco-asa, Splunk_TA_aws-kinesis-firehose, Splunk_TA_infoblox |
| 12 | spring4shell_payload_url_request | 5.0.1 | Splunk_TA_nginx | Splunk_TA_squid, Splunk_TA_citrix-netscaler, Splunk_TA_cisco-wsa, Splunk_TA_mcafee-wg, Splunk_TA_haproxy, Splunk_TA_websense-cg, Splunk_TA_microsoft-iis, Splunk_TA_nginx |
| 13 | log4shell_jndi_payload_injection_attempt | 5.0.1 | Splunk_TA_nginx | Splunk_TA_nginx |
| 14 | vmware_workspace_one_freemarker_server_side_template_injection | 5.0.1 | Splunk_TA_squid, Splunk_TA_citrix-netscaler, Splunk_TA_cisco-wsa, Splunk_TA_mcafee-wg, Splunk_TA_haproxy, Splunk_TA_websense-cg, Splunk_TA_microsoft-iis, Splunk_TA_nginx | |
| 15 | web_spring_cloud_function_functionrouter | 5.0.1 | Splunk_TA_squid, Splunk_TA_citrix-netscaler, Splunk_TA_cisco-wsa, Splunk_TA_mcafee-wg, Splunk_TA_haproxy, Splunk_TA_websense-cg, Splunk_TA_microsoft-iis, Splunk_TA_nginx | |
| 16 | web_jsp_request_via_url | 5.0.1 | Splunk_TA_nginx | Splunk_TA_squid, Splunk_TA_citrix-netscaler, Splunk_TA_cisco-wsa, Splunk_TA_mcafee-wg, Splunk_TA_haproxy, Splunk_TA_websense-cg, Splunk_TA_microsoft-iis, Splunk_TA_nginx |
| 17 | print_processor_registry_autostart | 5.0.1 | Splunk_TA_bit9-carbonblack | |
| 18 | dns_query_length_with_high_standard_deviation | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_isc-bind, Splunk_TA_CrowdStrike_FDR, Splunk_TA_infoblox |
| 19 | f5_big_ip_icontrol_rest_vulnerability_cve_2022_1388 | 5.0.1 | Splunk_TA_squid, Splunk_TA_citrix-netscaler, Splunk_TA_cisco-wsa, Splunk_TA_mcafee-wg, Splunk_TA_haproxy, Splunk_TA_websense-cg, Splunk_TA_microsoft-iis, Splunk_TA_nginx | |
| 20 | windows_service_initiation_on_remote_endpoint | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 21 | detect_regsvcs_spawning_a_process | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows |
| 22 | process_kill_base_on_file_path | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 23 | schtasks_scheduling_job_on_remote_system | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR |
| 24 | shim_database_installation_with_suspicious_parameters | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR |
| 25 | disabling_firewall_with_netsh | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 26 | windows_binary_proxy_execution_mavinject_dll_injection | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 27 | domain_controller_discovery_with_nltest | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 28 | detect_rundll32_application_control_bypass___syssetup | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 29 | windows_command_and_scripting_interpreter_path_traversal_exec | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 30 | slui_runas_elevated | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows |
| 31 | windows_hide_notification_features_through_registry | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack |
| 32 | silentcleanup_uac_bypass | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack |
| 33 | deleting_shadow_copies | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 34 | clop_common_exec_parameter | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 35 | windows_remote_service_rdpwinst_tool_execution | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 36 | wsreset_uac_bypass | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack |
| 37 | windows_nirsoft_advancedrun | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 38 | resize_shadowstorage_volume | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows |
| 39 | attempted_credential_dump_from_registry_via_reg_exe | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 40 | suspicious_process_file_path | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows |
| 41 | slui_spawning_a_process | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows |
| 42 | windows_modify_registry_disable_windows_security_center_notif | 5.0.1 | Splunk_TA_bit9-carbonblack | |
| 43 | registry_keys_for_creating_shim_databases | 5.0.1 | Splunk_TA_bit9-carbonblack | |
| 44 | wermgr_process_spawned_cmd_or_powershell_process | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 45 | linux_obfuscated_files_or_information_base64_decode | 5.0.1 | Splunk_TA_microsoft_sysmon | |
| 46 | windows_disableantispyware_reg | 5.0.1 | Splunk_TA_bit9-carbonblack | |
| 47 | disabling_norun_windows_app | 5.0.1 | Splunk_TA_bit9-carbonblack | |
| 48 | single_letter_process_on_endpoint | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_nix, Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_cyberark_epm, Splunk_TA_CrowdStrike_FDR |
| 49 | batch_file_write_to_system32 | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_nix, Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR |
| 50 | disabling_folderoptions_windows_feature | 5.0.1 | Splunk_TA_bit9-carbonblack | |
| 51 | linux_system_network_discovery | 5.0.1 | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR | |
| 52 | windows_curl_upload_to_remote_destination | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 53 | windows_disable_lock_workstation_feature_through_registry | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack |
| 54 | wsmprovhost_exe_lolbas_execution_process_spawn | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 55 | winword_spawning_cmd | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 56 | malicious_powershell_process___execution_policy_bypass | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 57 | vbscript_execution_using_wscript_app | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 58 | ntdsutil_export_ntds | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows |
| 59 | windows_system_shutdown_commandline | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 60 | detect_mshta_url_in_command_line | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 61 | jscript_execution_using_cscript_app | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows |
| 62 | windows_remote_services_allow_remote_assistance | 5.0.1 | Splunk_TA_bit9-carbonblack | |
| 63 | add_defaultuser_and_password_in_registry | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack |
| 64 | windows_adfind_exe | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows |
| 65 | fsutil_zeroing_file | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows |
| 66 | detect_rclone_command_line_usage | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 67 | remote_process_instantiation_via_wmi | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 68 | linux_possible_append_command_to_profile_config_file | 5.0.1 | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR | |
| 69 | windows_office_product_spawning_msdt | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 70 | nishang_powershelltcponeline | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 71 | excessive_usage_of_net_app | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 72 | detect_sharphound_usage | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 73 | dump_lsass_via_procdump | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR |
| 74 | domain_account_discovery_with_net_app | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows |
| 75 | windows_disable_shutdown_button_through_registry | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack |
| 76 | windows_modify_show_compress_color_and_info_tip_registry | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack |
| 77 | msbuild_suspicious_spawned_by_script_process | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 78 | excessive_usage_of_taskkill | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR |
| 79 | windows_impair_defense_deny_security_software_with_applocker | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 80 | windows_raccine_scheduled_task_deletion | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 81 | suspicious_rundll32_startw | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 82 | detect_psexec_with_accepteula_flag | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 83 | get_aduserresultantpasswordpolicy_with_powershell | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows |
| 84 | allow_file_and_printing_sharing_in_firewall | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 85 | eventvwr_uac_bypass | 5.0.1 | Splunk_TA_bit9-carbonblack | |
| 86 | regsvr32_silent_and_install_param_dll_loading | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 87 | windows_valid_account_with_never_expires_password | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 88 | detect_regsvcs_with_no_command_line_arguments | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 89 | change_to_safe_mode_with_network_config | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows |
| 90 | control_loading_from_world_writable_directory | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 91 | suspicious_scheduled_task_from_public_directory | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows |
| 92 | cmd_echo_pipe___escalation | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 93 | linux_possible_append_command_to_at_allow_config_file | 5.0.1 | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR | |
| 94 | winhlp32_spawning_a_process | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 95 | linux_doas_conf_file_creation | 5.0.1 | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack | |
| 96 | windows_modify_registry_disable_toast_notifications | 5.0.1 | Splunk_TA_bit9-carbonblack | |
| 97 | permission_modification_using_takeown_app | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack |
| 98 | detect_rundll32_application_control_bypass___advpack | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 99 | create_or_delete_windows_shares_using_net_exe | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 100 | anomalous_usage_of_7zip | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows |
| 101 | linux_install_kernel_module_using_modprobe_utility | 5.0.1 | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR | |
| 102 | windows_remote_assistance_spawning_process | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 103 | registry_keys_used_for_privilege_escalation | 5.0.1 | Splunk_TA_bit9-carbonblack | |
| 104 | windows_command_shell_dcrat_forkbomb_payload | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 105 | domain_account_discovery_with_wmic | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows |
| 106 | linux_change_file_owner_to_root | 5.0.1 | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR | |
| 107 | executables_or_script_creation_in_suspicious_path | 5.0.1 | Splunk_TA_bit9-carbonblack, Splunk_TA_CrowdStrike_FDR | |
| 108 | suspicious_copy_on_system32 | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 109 | certutil_download_with_urlcache_and_split_arguments | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 110 | windows_registry_modification_for_safe_mode_persistence | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack |
| 111 | hiding_files_and_directories_with_attrib_exe | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows |
| 112 | enable_rdp_in_other_port_number | 5.0.1 | Splunk_TA_bit9-carbonblack | |
| 113 | dsquery_domain_discovery | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR |
| 114 | credential_dumping_via_copy_command_from_shadow_copy | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 115 | get_foresttrust_with_powershell | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 116 | malicious_powershell_process_with_obfuscation_techniques | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 117 | creation_of_shadow_copy | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 118 | any_powershell_downloadstring | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 119 | bcdedit_command_back_to_normal_mode_boot | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows |
| 120 | windows_deleted_registry_by_a_non_critical_process_file_path | 5.0.1 | Splunk_TA_bit9-carbonblack | |
| 121 | detect_html_help_url_in_command_line | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 122 | windows_service_creation_using_registry_entry | 5.0.1 | Splunk_TA_bit9-carbonblack | |
| 123 | dump_lsass_via_comsvcs_dll | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 124 | linux_high_frequency_of_file_deletion_in_boot_folder | 5.0.1 | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack | |
| 125 | windows_curl_download_to_suspicious_path | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 126 | powershell_disable_security_monitoring | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 127 | icacls_grant_command | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR |
| 128 | nltest_domain_trust_discovery | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows |
| 129 | disable_amsi_through_registry | 5.0.1 | Splunk_TA_bit9-carbonblack | |
| 130 | detect_mshta_inline_hta_execution | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 131 | windows_rasautou_dll_execution | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 132 | mmc_exe_lolbas_execution_process_spawn | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 133 | recursive_delete_of_directory_in_batch_cmd | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 134 | revil_registry_entry | 5.0.1 | Splunk_TA_bit9-carbonblack | |
| 135 | linux_file_created_in_kernel_driver_directory | 5.0.1 | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack | |
| 136 | windows_system_time_discovery_w32tm_delay | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 137 | system_information_discovery_detection | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_nix, Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_cyberark_epm, Splunk_TA_CrowdStrike_FDR |
| 138 | uninstall_app_using_msiexec | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows |
| 139 | detect_rundll32_application_control_bypass___setupapi | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 140 | w3wp_spawning_shell | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 141 | windows_registry_delete_task_sd | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack |
| 142 | powershell_start_bitstransfer | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 143 | detect_regasm_spawning_a_process | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows |
| 144 | hide_user_account_from_sign_in_screen | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack |
| 145 | get_domaintrust_with_powershell | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 146 | samsam_test_file_write | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_nix, Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_cyberark, Splunk_TA_sophos, Splunk_TA_windows, splunk_ta_o365, Splunk_TA_CrowdStrike_FDR |
| 147 | prevent_automatic_repair_mode_using_bcdedit | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack |
| 148 | detect_regsvr32_application_control_bypass | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 149 | schtasks_used_for_forcing_a_reboot | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR |
| 150 | linux_deletion_of_services | 5.0.1 | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack | |
| 151 | svchost_exe_lolbas_execution_process_spawn | 5.0.1 | Splunk_TA_microsoft_sysmon | |
| 152 | windows_installutil_uninstall_option | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 153 | account_discovery_with_net_app | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 154 | disabling_systemrestore_in_registry | 5.0.1 | Splunk_TA_bit9-carbonblack | |
| 155 | linux_possible_ssh_key_file_creation | 5.0.1 | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack | |
| 156 | linux_nopasswd_entry_in_sudoers_file | 5.0.1 | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR | |
| 157 | create_local_admin_accounts_using_net_exe | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 158 | detect_processes_used_for_system_network_configuration_discovery | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 159 | processes_launching_netsh | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows |
| 160 | excessive_distinct_processes_from_windows_temp | 5.0.1 | Splunk_TA_windows | Splunk_TA_nix, Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_cyberark_epm, Splunk_TA_CrowdStrike_FDR |
| 161 | wget_download_and_bash_execution | 5.0.1 | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows | |
| 162 | process_creating_lnk_file_in_suspicious_location | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_CrowdStrike_FDR |
| 163 | bcdedit_failure_recovery_modification | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR |
| 164 | windows_remote_access_software_rms_registry | 5.0.1 | Splunk_TA_bit9-carbonblack | |
| 165 | services_escalate_exe | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows |
| 166 | scheduled_task_deleted_or_created_via_cmd | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows |
| 167 | wscript_or_cscript_suspicious_child_process | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 168 | linux_at_application_execution | 5.0.1 | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR | |
| 169 | windows_indirect_command_execution_via_forfiles | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows |
| 170 | windows_disable_logoff_button_through_registry | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack |
| 171 | sdclt_uac_bypass | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack |
| 172 | clear_unallocated_sector_using_cipher_app | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 173 | usn_journal_deletion | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows |
| 174 | certutil_with_decode_argument | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 175 | linux_service_restarted | 5.0.1 | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR | |
| 176 | credential_dumping_via_symlink_to_shadow_copy | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 177 | conti_common_exec_parameter | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 178 | fodhelper_uac_bypass | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows |
| 179 | disable_schedule_task | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR |
| 180 | windows_system_reboot_commandline | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 181 | detect_azurehound_command_line_arguments | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 182 | remote_wmi_command_attempt | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows |
| 183 | linux_file_creation_in_init_boot_directory | 5.0.1 | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack | |
| 184 | active_setup_registry_autostart | 5.0.1 | Splunk_TA_bit9-carbonblack | |
| 185 | linux_possible_access_to_credential_files | 5.0.1 | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR | |
| 186 | disabling_controlpanel | 5.0.1 | Splunk_TA_bit9-carbonblack | |
| 187 | windows_impair_defense_delete_win_defender_profile_registry | 5.0.1 | Splunk_TA_bit9-carbonblack | |
| 188 | possible_lateral_movement_powershell_spawn | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 189 | dns_exfiltration_using_nslookup_app | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 190 | detect_path_interception_by_creation_of_program_exe | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 191 | linux_visudo_utility_execution | 5.0.1 | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR | |
| 192 | elevated_group_discovery_with_wmic | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 193 | suspicious_regsvr32_register_suspicious_path | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 194 | suspicious_rundll32_plugininit | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 195 | bits_job_persistence | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 196 | sc_exe_manipulating_windows_services | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR |
| 197 | shim_database_file_creation | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_ossec, Splunk_TA_nix, Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_CrowdStrike_FDR |
| 198 | excessive_number_of_taskhost_processes | 5.0.1 | Splunk_TA_windows | Splunk_TA_nix, Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR |
| 199 | scheduled_task_initiation_on_remote_endpoint | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 200 | bitsadmin_download_file | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 201 | office_product_spawning_rundll32_with_no_dll | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 202 | disable_registry_tool | 5.0.1 | Splunk_TA_bit9-carbonblack | |
| 203 | linux_decode_base64_to_shell | 5.0.1 | Splunk_TA_microsoft_sysmon | |
| 204 | curl_download_and_bash_execution | 5.0.1 | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows | |
| 205 | elevated_group_discovery_with_net | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 206 | disabling_cmd_application | 5.0.1 | Splunk_TA_bit9-carbonblack | |
| 207 | linux_deletion_of_ssl_certificate | 5.0.1 | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack | |
| 208 | short_lived_windows_accounts | 5.0.1 | Splunk_TA_cyberark, Splunk_TA_microsoft-cloudservices, Splunk_TA_rsa-securid, Splunk_TA_aws-kinesis-firehose | |
| 209 | spoolsv_writing_a_dll | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_nix, Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_CrowdStrike_FDR |
| 210 | get_domainuser_with_powershell | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows |
| 211 | ryuk_wake_on_lan_command | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows |
| 212 | unified_messaging_service_spawning_a_process | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows |
| 213 | getwmiobject_ds_user_with_powershell | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows |
| 214 | office_application_spawn_regsvr32_process | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 215 | disable_etw_through_registry | 5.0.1 | Splunk_TA_bit9-carbonblack | |
| 216 | rundll32_with_no_command_line_arguments_with_network | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 217 | office_product_spawning_mshta | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 218 | excessive_number_of_service_control_start_as_disabled | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows |
| 219 | windows_odbcconf_load_response_file | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 220 | certutil_download_with_verifyctl_and_split_arguments | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 221 | linux_deletion_of_cron_jobs | 5.0.1 | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack | |
| 222 | suspicious_msbuild_spawn | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 223 | execution_of_file_with_multiple_extensions | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows |
| 224 | windows_impair_defenses_disable_win_defender_auto_logging | 5.0.1 | Splunk_TA_bit9-carbonblack | |
| 225 | linux_kernel_module_enumeration | 5.0.1 | Splunk_TA_microsoft_sysmon | |
| 226 | office_product_spawn_cmd_process | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 227 | windows_disable_memory_crash_dump | 5.0.1 | Splunk_TA_bit9-carbonblack | |
| 228 | serviceprincipalnames_discovery_with_setspn | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 229 | linux_doas_tool_execution | 5.0.1 | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR | |
| 230 | suspicious_rundll32_dllregisterserver | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 231 | suspicious_microsoft_workflow_compiler_usage | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 232 | excessive_usage_of_cacls_app | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR |
| 233 | linux_iptables_firewall_modification | 5.0.1 | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR | |
| 234 | remote_process_instantiation_via_winrm_and_powershell | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 235 | getdomaincomputer_with_powershell | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 236 | suspicious_icedid_rundll32_cmdline | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 237 | linux_java_spawning_shell | 5.0.1 | Splunk_TA_microsoft_sysmon | |
| 238 | windows_schtasks_create_run_as_system | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 239 | firewall_allowed_program_enable | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows |
| 240 | suspicious_gpupdate_no_command_line_arguments | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 241 | windows_registry_certificate_added | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack |
| 242 | suspicious_mshta_spawn | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 243 | revil_common_exec_parameter | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack |
| 244 | wmic_xsl_execution_via_url | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 245 | potentially_malicious_code_on_commandline | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows |
| 246 | linux_ssh_remote_services_script_execute | 5.0.1 | Splunk_TA_microsoft_sysmon | |
| 247 | mimikatz_passtheticket_commandline_parameters | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows |
| 248 | windows_modify_registry_regedit_silent_reg_import | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 249 | monitor_registry_keys_for_print_monitors | 5.0.1 | Splunk_TA_bit9-carbonblack | |
| 250 | cmdline_tool_not_executed_in_cmd_shell | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 251 | windows_dism_remove_defender | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 252 | detect_html_help_using_infotech_storage_handlers | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 253 | detect_html_help_spawn_child_process | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 254 | detect_rundll32_inline_hta_execution | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 255 | time_provider_persistence_registry | 5.0.1 | Splunk_TA_bit9-carbonblack | |
| 256 | attacker_tools_on_endpoint | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows |
| 257 | windows_service_stop_by_deletion | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows |
| 258 | excessive_service_stop_attempt | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 259 | icacls_deny_command | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR |
| 260 | linux_deleting_critical_directory_using_rm_command | 5.0.1 | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR | |
| 261 | disable_windows_behavior_monitoring | 5.0.1 | Splunk_TA_bit9-carbonblack | |
| 262 | script_execution_via_wmi | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_nix, Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_cyberark_epm, Splunk_TA_CrowdStrike_FDR |
| 263 | secretdumps_offline_ntds_dumping_tool | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack |
| 264 | remote_process_instantiation_via_winrm_and_winrs | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 265 | suspicious_msbuild_path | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 266 | suspicious_mshta_child_process | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows |
| 267 | linux_clipboard_data_copy | 5.0.1 | Splunk_TA_microsoft_sysmon | |
| 268 | rubeus_command_line_parameters | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows |
| 269 | set_default_powershell_execution_policy_to_unrestricted_or_bypass | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack |
| 270 | linux_disable_services | 5.0.1 | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR | |
| 271 | unload_sysmon_filter_driver | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR |
| 272 | process_execution_via_wmi | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR |
| 273 | disabling_task_manager | 5.0.1 | Splunk_TA_bit9-carbonblack | |
| 274 | certutil_exe_certificate_extraction | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 275 | windows_disable_windows_group_policy_features_through_registry | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack |
| 276 | file_with_samsam_extension | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_nix, Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_cyberark, Splunk_TA_sophos, Splunk_TA_windows, splunk_ta_o365, Splunk_TA_CrowdStrike_FDR |
| 277 | rundll32_control_rundll_world_writable_directory | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 278 | getdomaingroup_with_powershell | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 279 | change_default_file_association | 5.0.1 | Splunk_TA_bit9-carbonblack | |
| 280 | rundll32_lockworkstation | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows |
| 281 | ping_sleep_batch_command | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 282 | disabling_remote_user_account_control | 5.0.1 | Splunk_TA_bit9-carbonblack | |
| 283 | linux_sudoers_tmp_file_creation | 5.0.1 | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack | |
| 284 | overwriting_accessibility_binaries | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_ossec, Splunk_TA_nix, Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_cyberark, Splunk_TA_sophos, Splunk_TA_windows, splunk_ta_o365, Splunk_TA_CrowdStrike_FDR |
| 285 | rundll_loading_dll_by_ordinal | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 286 | linux_possible_access_or_modification_of_sshd_config_file | 5.0.1 | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR | |
| 287 | system_processes_run_from_unexpected_locations | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_CrowdStrike_FDR |
| 288 | spoolsv_spawning_rundll32 | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 289 | windows_security_account_manager_stopped | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_nix, Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_cyberark_epm, Splunk_TA_CrowdStrike_FDR |
| 290 | windows_process_with_namedpipe_commandline | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 291 | wbadmin_delete_system_backups | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR |
| 292 | xsl_script_execution_with_wmic | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows |
| 293 | linux_add_files_in_known_crontab_directories | 5.0.1 | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack | |
| 294 | extraction_of_registry_hives | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 295 | suspicious_rundll32_with_no_command_line_arguments | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 296 | windows_mof_event_triggered_execution_via_wmi | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 297 | registry_keys_used_for_persistence | 5.0.1 | Splunk_TA_bit9-carbonblack | |
| 298 | windows_modify_registry_disable_win_defender_raw_write_notif | 5.0.1 | Splunk_TA_bit9-carbonblack | |
| 299 | scheduled_task_creation_on_remote_endpoint_using_at | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 300 | excessive_attempt_to_disable_services | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR |
| 301 | windows_indirect_command_execution_via_pcalua | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows |
| 302 | windows_dotnet_binary_in_non_standard_path | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 303 | suspicious_searchprotocolhost_no_command_line_arguments | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 304 | windows_msiexec_unregister_dllregisterserver | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 305 | attempt_to_stop_security_service | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 306 | windows_installutil_in_non_standard_path | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 307 | java_class_file_download_by_java_user_agent | 5.0.1 | Splunk_TA_squid, Splunk_TA_citrix-netscaler, Splunk_TA_cisco-wsa, Splunk_TA_mcafee-wg, Splunk_TA_haproxy, Splunk_TA_websense-cg, Splunk_TA_microsoft-iis, Splunk_TA_nginx | |
| 308 | linux_deletion_of_init_daemon_script | 5.0.1 | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack | |
| 309 | getwmiobject_ds_computer_with_powershell | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 310 | linux_stop_services | 5.0.1 | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR | |
| 311 | net_profiler_uac_bypass | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack |
| 312 | windows_msiexec_spawn_discovery_command | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 313 | linux_ssh_authorized_keys_modification | 5.0.1 | Splunk_TA_microsoft_sysmon | |
| 314 | windows_disable_change_password_through_registry | 5.0.1 | Splunk_TA_bit9-carbonblack | |
| 315 | windows_remote_services_rdp_enable | 5.0.1 | Splunk_TA_bit9-carbonblack | |
| 316 | linux_at_allow_config_file_creation | 5.0.1 | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack | |
| 317 | excel_spawning_powershell | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 318 | logon_script_event_trigger_execution | 5.0.1 | Splunk_TA_bit9-carbonblack | |
| 319 | windows_processes_killed_by_industroyer2_malware | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 320 | impacket_lateral_movement_commandline_parameters | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 321 | detect_regasm_with_no_command_line_arguments | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 322 | office_application_spawn_rundll32_process | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 323 | windows_installutil_url_in_command_line | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 324 | allow_operation_with_consent_admin | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack |
| 325 | linux_preload_hijack_library_calls | 5.0.1 | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR | |
| 326 | windows_installutil_credential_theft | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 327 | windows_service_create_kernel_mode_driver | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 328 | disabling_net_user_account | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 329 | detect_exchange_web_shell | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_CrowdStrike_FDR |
| 330 | windows_system_logoff_commandline | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 331 | windows_msiexec_remote_download | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 332 | detect_use_of_cmd_exe_to_launch_script_interpreters | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows |
| 333 | regsvr32_with_known_silent_switch_cmdline | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 334 | linux_pkexec_privilege_escalation | 5.0.1 | Splunk_TA_microsoft_sysmon | |
| 335 | reg_exe_manipulating_windows_services_registry_keys | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR |
| 336 | linux_insert_kernel_module_using_insmod_utility | 5.0.1 | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR | |
| 337 | add_or_set_windows_defender_exclusion | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 338 | suspicious_linux_discovery_commands | 5.0.1 | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR | |
| 339 | office_product_spawning_wmic | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 340 | disable_logs_using_wevtutil | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack |
| 341 | deleting_of_net_users | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 342 | sdelete_application_execution | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 343 | remote_process_instantiation_via_wmi_and_powershell | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 344 | rundll32_shimcache_flush | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 345 | suspicious_writes_to_windows_recycle_bin | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_CrowdStrike_FDR |
| 346 | modify_acl_permission_to_files_or_folder | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR |
| 347 | windows_remote_services_allow_rdp_in_firewall | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows |
| 348 | any_powershell_downloadfile | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 349 | schtasks_run_task_on_demand | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR |
| 350 | remote_system_discovery_with_wmic | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 351 | suspicious_reg_exe_process | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR |
| 352 | windows_msiexec_dllregisterserver | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 353 | linux_possible_access_to_sudoers_file | 5.0.1 | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR | |
| 354 | windows_modify_registry_disabling_wer_settings | 5.0.1 | Splunk_TA_bit9-carbonblack | |
| 355 | remote_process_instantiation_via_dcom_and_powershell | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 356 | screensaver_event_trigger_execution | 5.0.1 | Splunk_TA_bit9-carbonblack | |
| 357 | get_domainpolicy_with_powershell | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows |
| 358 | msmpeng_application_dll_side_loading | 5.0.1 | Splunk_TA_bit9-carbonblack, Splunk_TA_CrowdStrike_FDR | |
| 359 | services_exe_lolbas_execution_process_spawn | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 360 | auto_admin_logon_registry_entry | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack |
| 361 | ryuk_test_files_detected | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_nix, Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_cyberark, Splunk_TA_sophos, Splunk_TA_windows, splunk_ta_o365, Splunk_TA_CrowdStrike_FDR |
| 362 | check_elevated_cmd_using_whoami | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows |
| 363 | creation_of_shadow_copy_with_wmic_and_powershell | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 364 | linux_shred_overwrite_command | 5.0.1 | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR | |
| 365 | windows_file_without_extension_in_critical_folder | 5.0.1 | Splunk_TA_bit9-carbonblack | |
| 366 | linux_dd_file_overwrite | 5.0.1 | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR | |
| 367 | disable_windows_app_hotkeys | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack |
| 368 | getwmiobject_ds_group_with_powershell | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 369 | office_spawning_control | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 370 | execute_javascript_with_jscript_com_clsid | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows |
| 371 | mshta_spawning_rundll32_or_regsvr32_process | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 372 | allow_network_discovery_in_firewall | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 373 | suspicious_dllhost_no_command_line_arguments | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 374 | linux_high_frequency_of_file_deletion_in_etc_folder | 5.0.1 | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack | |
| 375 | winword_spawning_powershell | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 376 | windows_modify_registry_disallow_windows_app | 5.0.1 | Splunk_TA_bit9-carbonblack | |
| 377 | detect_sharphound_command_line_arguments | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows |
| 378 | wmiprsve_exe_lolbas_execution_process_spawn | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 379 | suspicious_wevtutil_usage | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR |
| 380 | windows_execute_arbitrary_commands_with_msdt | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 381 | linux_service_started_or_enabled | 5.0.1 | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR | |
| 382 | office_document_spawned_child_process_to_download | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 383 | windows_odbcconf_load_dll | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 384 | attempt_to_add_certificate_to_untrusted_store | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows |
| 385 | linux_setuid_using_setcap_utility | 5.0.1 | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR | |
| 386 | windows_modify_registry_suppress_win_defender_notif | 5.0.1 | Splunk_TA_bit9-carbonblack | |
| 387 | linux_setuid_using_chmod_utility | 5.0.1 | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack, Splunk_TA_windows, Splunk_TA_CrowdStrike_FDR | |
| 388 | office_product_spawning_certutil | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 389 | linux_file_creation_in_profile_directory | 5.0.1 | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack | |
| 390 | windows_service_creation_on_remote_endpoint | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 391 | linux_account_manipulation_of_ssh_config_and_keys | 5.0.1 | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack | |
| 392 | office_product_spawning_bitsadmin | 5.0.1 | Splunk_TA_microsoft_sysmon | Splunk_TA_microsoft_sysmon |
| 393 | linux_service_file_created_in_systemd_directory | 5.0.1 | Splunk_TA_microsoft_sysmon, Splunk_TA_bit9-carbonblack |