Detects when the ScreenConnect client (ConnectWise Control) connects to a newly observed host server that is not the official ScreenConnect cloud. ScreenConnect is a common RMM/remote access tool ...
Active Directory replication is the process by which the changes that originate on one domain controller are automatically transferred to other domain controllers that store the same data. Active ...
Qakbot-favored process execution after anomalous Excel spawning Use this query to find Excel launching anomalous processes congruent with Qakbot payloads which contain additional markers from recent ...
When you have a lot of users changing data, it’s easy for things to go wrong. But if you keep an audit trail of data input changes, you’ll be able to determine which operators are consistently making ...
Some results have been hidden because they may be inaccessible to you
Show inaccessible results