Supported detections in behavioral analytics service

Behavioral analytics service supports the following detections. More information about each detection is available on the Splunk Security Content website.

• Anomalous Usage of Account Credentials
• Anomalous Usage of Archive Tools
• Attempt To Delete Services
• Attempt To Disable Services
• Attempt to Dump Credentials from Registry Using Reg.exe
• BCDEdit Failure Recovery Modification
• Clear Unallocated Sector Using Cipher App
• Credential Extraction Indicative of Lazagne Command Line Options
• Delete A Net User
• Deny Permission using Cacls Utility
• Detect Dump LSASS Memory Using comsvcs
• Detect Kerberoasting
• Detect Prohibited Applications Spawning cmd.exe
• Detect RClone Command-Line Usage
• Disable Net User Account
• Disable Defender AntiVirus Registry
• DNS Exfiltration Using Nslookup App
• Excessive Number of Office Files Copied
• First time seen command line argument
• Fsutil Zeroing File
• Grant Permission Using Cacls Utility
• High File Deletion Frequency
• Hiding Files And Directories With Attrib.exe
• Modify ACL Permission To Files Or Folder
• More than Usual Number of LOLBAS Applications in Short Time Period
• Phishing Email Detection by Machine Learning Method - SSA
• Rare Parent-Child Process Relationship
• Reconnaissance and Access to Shared Resources using PowerSploit Modules
• Reconnaissance of Access and Persistence Opportunities using PowerSploit Modules
• Reconnaissance of Connectivity using PowerSploit modules
• Reconnaissance of Process or Service Hijacking Opportunities using Mimikatz Modules
• Resize ShadowStorage Volume
• Sdelete Application Execution
• System Process Running from Unexpected Location
• TCP Command and Scripting Interpreter Outbound LDAP Traffic
• Unusual Volume of Data Download from Internal Server Per Entity
• WBAdmin Delete System Backups
• WevtUtil Usage to Clear Logs
• WevtUtil Usage to Disable Logs
• Windows Bitsadmin Download File
• Windows Bits Job Persistence
• Windows Curl Upload to Remote Destination
• Windows CertUtil Decode File
• Windows CertUtil URLCache Download
• Windows CertUtil VerifyCtl Download
• Windows Curl Upload to Remote Destination
• Windows Diskshadow Proxy Execution
• Windows Eventvwr UAC Bypass
• Windows MSHTA Child Process
• Windows MSHTA Command-Line URL
• Windows MSHTA Inline HTA Execution
• Windows Powershell Connect to Internet With Hidden Window
• Windows Powershell DownloadFile
• Windows PowerShell Start-BitsTransfer
• Windows Rundll32 Inline HTA Execution
• Windows WSReset UAC Bypass