Supported detections in behavioral analytics service

Behavioral analytics service supports the following detections. More information about each detection is available on the Splunk Security Content website.

• Attempt To delete Services
• Attempt To Disable Services
• Credential Extraction indicative of Lazagne command line options
• Delete A Net User
• Deny Permission using Calcs Utility
• Detect Prohibited Applications Spawning cmd exe
• Disable Net User Account
• Grant Permission Using Cacls Utility
• Modify ACL permission To Files Or Folder
• More than usual number of LOLBAS applications in short time period
• Potential Pass the Token or Hash Observed at the Destination Device
• Potential Pass the Token or Hash Observed by an Event Collecting Device
• Reconnaissance and Access to Shared Resources via PowerSploit modules
• Reconnaissance of Access and Persistence Opportunities via PowerSploit modules
• Reconnaissance of Connectivity via PowerSploit modules
• Reconnaissance of Process or Service Hijacking Opportunities via Mimikatz modules
• Resize ShadowStorage Volume
• WevUtil Usage to Clear Logs
• WevUtil Usage to Disable Logs