UEBA detection reference for UEBA cloud
list of available detections for cloud deployments
The following UEBA detections are available in cloud deployments of Splunk Enterprise Security:
| Detection name | Detection type | Data source |
|---|---|---|
| UEBA - Abnormal Administrative Activity Model | ML | raw sourcetype supported only (Windows, Otka) |
| UEBA - Abnormal Email Handle Similarity and Time Activity Model | ML | Email Activity UEBA Dataset |
| UEBA - Abnormal Email Recipient Count and Time Activity Model | ML | Email Activity UEBA Dataset |
| UEBA - Abnormal Email Source IP and Time Activity Model | ML | Email Activity UEBA Dataset |
| UEBA - Abnormal Email Temporal Activity Model | ML | Email Activity UEBA Dataset |
| UEBA - Abnormal Group Changes Administrative Activity Model | ML | raw sourcetype supported only (Okta,Windows) |
| UEBA - Abnormal Okta Application Activity Model - Actor User | ML | raw sourcetype supported only (Okta) |
| UEBA - Abnormal Okta Application Activity Model - App Category | ML | raw sourcetype supported only (Okta) |
| UEBA - Abnormal Okta Login Source IP Activity Model | ML | raw sourcetype supported only (Okta) |
| UEBA - Abnormal Okta Login Target User Activity Model | ML | raw sourcetype supported only (Okta) |
| UEBA - Abnormal Okta Login Temporal Activity Model | ML | raw sourcetype supported only (Okta) |
| UEBA - Abnormal Okta Login User Agent Activity Model | ML | raw sourcetype supported only (Okta) |
| UEBA - Abnormal Privileges Activity Model | ML | raw sourcetype supported only (Okta,Windows) |
| UEBA - Abnormal RDP Login Active Directory | ML | raw sourcetype supported only (Windows) |
| UEBA - Abnormal Source IP during Administrative Activity Model | ML | raw sourcetype supported only (Okta,Windows) |
| UEBA - Abnormal User Agent during Administrative Activity Model | ML | raw sourcetype supported only (Okta,Windows) |
| UEBA - Account Creation Deletion In Short Span | Rule | raw sourcetype supported only (Windows) |
| UEBA - Anomalous usage of Archive Tools | Streaming | raw sourcetype supported only (Windows) |
| UEBA - Attempt To Delete Services | Streaming | raw sourcetype supported only (Windows) |
| UEBA - Attempt To Disable Services | Streaming | raw sourcetype supported only (Windows) |
| UEBA - Attempted Credential Dump From Registry via Reg exe | Streaming | raw sourcetype supported only (Windows) |
| UEBA - BCDEdit Failure Recovery Modification | Streaming | raw sourcetype supported only (Windows) |
| UEBA - Brute Force Login By User and Failure Reason In Active Directory | ML | Authentication UEBA Dataset |
| UEBA - Brute Force Login Failures By Device In Active Directory | ML | Authentication UEBA Dataset |
| UEBA - Clear Unallocated Sector Using Cipher App | Streaming | raw sourcetype supported only (Windows) |
| UEBA - Cloud Storage New Access Data Model | ML | raw sourcetype supported only (O365, Box) |
| UEBA - Create Local Admin Accounts Using Net Exe | Streaming | raw sourcetype supported only (Windows) |
| UEBA - Create Local User Accounts Using Net Exe | Streaming | raw sourcetype supported only (Windows) |
| UEBA - Delete A Net User | Streaming | raw sourcetype supported only (Windows) |
| UEBA - Deleting Shadow Copies | Streaming | raw sourcetype supported only (Windows) |
| UEBA - Deny Permission using Cacls Utility | Streaming | raw sourcetype supported only (Windows) |
| UEBA - Detect PowerShell Applications Spawning cmd exe | Streaming | raw sourcetype supported only (Windows) |
| UEBA - Detect Prohibited Browsers Spawning cmd exe | Streaming | raw sourcetype supported only (Windows) |
| UEBA - Detect Prohibited Office Applications Spawning cmd exe | Streaming | raw sourcetype supported only (Windows) |
| UEBA - Detect RClone Command-Line Usage | Streaming | raw sourcetype supported only (Windows) |
| UEBA - Disable Net User Account | Streaming | raw sourcetype supported only (Windows) |
| UEBA - DNS Exfiltration Using Nslookup App | Streaming | raw sourcetype supported only (Windows) |
| UEBA - Email Similarity Detection | ML | Email Activity UEBA Dataset |
| UEBA - Excessive File Size Change Model | ML | raw sourcetype supported only (O365, Box) |
| UEBA - Fsutil Zeroing File | Streaming | raw sourcetype supported only (Windows) |
| UEBA - Grant Permission Using Cacls Utility | Streaming | raw sourcetype supported only (Windows) |
| UEBA - Hiding Files And Directories With Attrib exe | ML | raw sourcetype supported only (Windows) |
| UEBA - Impacket Lateral Movement smbexec CommandLine Parameters | Streaming | raw sourcetype supported only (Windows) |
| UEBA - Impacket Lateral Movement WMIExec Commandline Parameters | Streaming | raw sourcetype supported only (Windows) |
| UEBA - Land Speed Violation | Rule | raw sourcetype supported only (Cisco ASA, Palo GlobalProtect) |
| UEBA - Member Added Removed In Short Span | Rule | raw sourcetype supported only (Windows) |
| UEBA - Modify ACLs Permission Of Files Or Folders | Streaming | raw sourcetype supported only (Windows) |
| UEBA - Office Product Spawning Windows Script Host | Streaming | raw sourcetype supported only (Windows) |
| UEBA - Password Policy Circumvention | Rule | raw sourcetype supported only (Windows) |
| UEBA - Password Spraying In Active Directory Authentication Data | ML | raw sourcetype supported only (Windows) |
| UEBA - Password Spraying In Active Directory Data | ML | raw sourcetype supported only (Windows) |
| UEBA - Password Spraying In O365 Management Data | ML | raw sourcetype supported only (O365) |
| UEBA - Password Spraying In Okta Data | ML | raw sourcetype supported only (Okta) |
| UEBA - Possible Lateral Movement PowerShell Spawn | Streaming | raw sourcetype supported only (Windows) |
| UEBA - Powershell Obfuscation Detection | ML | Process Activity UEBA Dataset |
| UEBA - Powershell Suspicious Script Detection | ML | Process Activity UEBA Dataset |
| UEBA - Rare Device Authentication by Windows User | ML | raw sourcetype supported only (Windows) |
| UEBA - Rare Device Authentication by Windows User Business Unit | ML | raw sourcetype supported only (Windows) |
| UEBA - Rare Device Login by Windows User | ML | raw sourcetype supported only (Windows) |
| UEBA - Rare File Access by User | ML | raw sourcetype supported only (O365, Box) |
| UEBA - Rare File Access by User Business Unit | ML | raw sourcetype supported only (O365, Box) |
| UEBA - Rare File Activity by Company | ML | raw sourcetype supported only (O365, Box) |
| UEBA - Rare File Activity by User | ML | raw sourcetype supported only (O365, Box) |
| UEBA - Rare File Activity by User Business Unit | ML | raw sourcetype supported only (O365, Box) |
| UEBA - Rare File Client by Company | ML | raw sourcetype supported only (O365, Box) |
| UEBA - Rare File Client by User | ML | raw sourcetype supported only (O365, Box) |
| UEBA - Rare File Client by User Business Unit | ML | raw sourcetype supported only (O365, Box) |
| UEBA - Rare Successful VPN Login Location by Company | ML | raw sourcetype supported only (Cisco ASA, Palo GlobalProtect) |
| UEBA - Rare Successful VPN Login Location by Device | ML | raw sourcetype supported only (Cisco ASA, Palo GlobalProtect) |
| UEBA - Rare Successful VPN Login Location by User | ML | raw sourcetype supported only (Cisco ASA, Palo GlobalProtect) |
| UEBA - Rare Successful VPN Login Location by User Business Unit | ML | raw sourcetype supported only (Cisco ASA, Palo GlobalProtect) |
| UEBA - Rare Windows Authentication Return Code by Device | ML | raw sourcetype supported only (Windows) |
| UEBA - Rare Windows Authentication Return Code by User | ML | raw sourcetype supported only (Windows) |
| UEBA - Rare Windows Authentication Return Code by User Business Unit | ML | raw sourcetype supported only (Windows) |
| UEBA - Rare Windows Device Login by User Business Unit | ML | raw sourcetype supported only (Windows) |
| UEBA - Rare Windows Domain Authentication by User | ML | raw sourcetype supported only (Windows) |
| UEBA - Rare Windows Domain Authentication by User Business Unit | ML | raw sourcetype supported only (Windows) |
| UEBA - Rare Windows Domain Login by User | ML | raw sourcetype supported only (Windows) |
| UEBA - Rare Windows Domain Login by User Business Unit | ML | raw sourcetype supported only (Windows) |
| UEBA - Rare Windows Event Code by User | ML | raw sourcetype supported only (Windows) |
| UEBA - Rare Windows Event Code by User Business Unit | ML | raw sourcetype supported only (Windows) |
| UEBA - Rare Windows Login Return Code by Device | ML | raw sourcetype supported only (Windows) |
| UEBA - Rare Windows Login Return Code by User | ML | raw sourcetype supported only (Windows) |
| UEBA - Rare Windows Login Return Code by User Business Unit | ML | raw sourcetype supported only (Windows) |
| UEBA - Rare Windows Logon Process by Device | ML | raw sourcetype supported only (Windows) |
| UEBA - Rare Windows Logon Process by User | ML | raw sourcetype supported only (Windows) |
| UEBA - Rare Windows Logon Process by User and Device | ML | raw sourcetype supported only (Windows) |
| UEBA - Rare Windows Logon Process by User Business Unit | ML | raw sourcetype supported only (Windows) |
| UEBA - Rare Windows Logon Type by Device | ML | raw sourcetype supported only (Windows) |
| UEBA - Rare Windows Logon Type by User | ML | raw sourcetype supported only (Windows) |
| UEBA - Rare Windows Logon Type by User Business Unit | ML | raw sourcetype supported only (Windows) |
| UEBA - Rare Windows Process Name by Device | ML | raw sourcetype supported only (Windows) |
| UEBA - Rare Windows Process Name by User | ML | raw sourcetype supported only (Windows) |
| UEBA - Rare Windows Process Name by User Business Unit | ML | raw sourcetype supported only (Windows) |
| UEBA - Rare Windows Resource Type by User | ML | raw sourcetype supported only (Windows) |
| UEBA - Rare Windows Resource Type by User Business Unit | ML | raw sourcetype supported only (Windows) |
| UEBA - Rare Windows User Authentication by Device | ML | raw sourcetype supported only (Windows) |
| UEBA - Rare Windows User Login by Device | ML | raw sourcetype supported only (Windows) |
| UEBA - Resize Shadowstorage Volume | Streaming | raw sourcetype supported only (Windows) |
| UEBA - Sdelete Application Execution | Streaming | raw sourcetype supported only (Windows) |
| UEBA - ServicePrincipalNames Discovery with PowerShell | ML | raw sourcetype supported only (Windows) |
| UEBA - System Process Running from Unexpected Location | Streaming | raw sourcetype supported only (Windows) |
| UEBA - Unauthorized Activity Time | Rule | raw sourcetype supported only (Windows) |
| UEBA - Unauthorized Login Type | Rule | raw sourcetype supported only (Windows) |
| UEBA - Unauthorized Machine Login | Rule | raw sourcetype supported only (Windows) |
| UEBA - Unusual Account Provisioning from Abnormal Source IP | ML | raw sourcetype supported only (Windows) |
| UEBA - Unusual Account Provisioning using Abnormal User Agent | ML | raw sourcetype supported only (Windows) |
| UEBA - Unusual Large Email Size Sent Per User | ML | Email Activity UEBA Dataset |
| UEBA - Unusual Login Hour Of The Day | ML | Authentication UEBA Dataset |
| UEBA - Unusual Print Time per Printer | ML | Base Printer UEBA dataset |
| UEBA - Unusual Print Time per User | ML | Base Printer UEBA Dataset |
| UEBA - Unusual Service Account Login via VPN | Rule | raw sourcetype supported only (Cisco ASA, Palo GlobalProtect) |
| UEBA - Unusual Volume of Active Directory Authentication Failures | ML | Authentication UEBA Dataset |
| UEBA - Unusual Volume of Active Directory Login Failures | ML | Authentication UEBA Dataset |
| UEBA - Unusual Volume of Application Activity in Okta | ML | raw sourcetype supported only (Okta) |
| UEBA - Unusual Volume of Blocked Connections per Device | ML | Network Traffic UEBA Dataset |
| UEBA - Unusual Volume of Blocked Connections per Device by Business Unit | ML | Network Traffic UEBA Dataset |
| UEBA - Unusual Volume of Blocked Connections per Device by Company | ML | Network Traffic UEBA Dataset |
| UEBA - Unusual Volume Of Blocked Connections Per User | ML | Network Traffic UEBA Dataset |
| UEBA - Unusual Volume Of Blocked Connections Per User By Business Unit | ML | Network Traffic UEBA Dataset |
| UEBA - Unusual Volume Of Blocked Connections Per User By Company | ML | Network Traffic UEBA Dataset |
| UEBA - Unusual Volume of Box Login Failures | ML | raw sourcetype supported only (Box) |
| UEBA - Unusual Volume Of Bytes Read From USB Per User | ML | Base USB UEBA Dataset |
| UEBA - Unusual Volume Of Bytes Read From USB Per User By Company | ML | Base USB UEBA Dataset |
| UEBA - Unusual Volume Of Bytes Written To USB Per User | ML | Base USB UEBA Dataset |
| UEBA - Unusual Volume Of Bytes Written To USB Per User By Company | ML | Base USB UEBA Dataset |
| UEBA - Unusual Volume of Cloud File Activity | ML | raw sourcetype supported only (O365, Box) |
| UEBA - Unusual Volume of Cloud File Deletions | ML | raw sourcetype supported only (O365, Box) |
| UEBA - Unusual Volume of Cloud File Downloads | ML | raw sourcetype supported only (O365, Box) |
| UEBA - Unusual Volume of Data Bytes per Device | ML | Network Traffic UEBA Dataset |
| UEBA - Unusual Volume of Data Bytes per Device by Business Unit | ML | Network Traffic UEBA Dataset |
| UEBA - Unusual Volume of Data Bytes per Device by Company | ML | Network Traffic UEBA Dataset |
| UEBA - Unusual Volume Of Data Downloaded From Internal Server Per User | ML | Network Traffic UEBA Dataset |
| UEBA - Unusual Volume Of Data Downloaded From Internal Server Per User By Business Unit | ML | Network Traffic UEBA Dataset |
| UEBA - Unusual Volume Of Data Downloaded From Internal Server Per User By Company | ML | Network Traffic UEBA Dataset |
| UEBA - Unusual Volume of Data Downloaded per Device | ML | Network Traffic UEBA Dataset |
| UEBA - Unusual Volume of Data Downloaded per Device by Business Unit | ML | Network Traffic UEBA Dataset |
| UEBA - Unusual Volume of Data Downloaded per Device by Company | ML | Network Traffic UEBA Dataset |
| UEBA - Unusual Volume of Data Downloaded per User | ML | Network Traffic UEBA Dataset |
| UEBA - Unusual Volume Of Data Downloaded Per User By Business Unit | ML | Network Traffic UEBA Dataset |
| UEBA - Unusual Volume of Data Downloaded per User by Company | ML | Network Traffic UEBA Dataset |
| UEBA - Unusual Volume of Data Transmitted to Printer per Device | ML | Base Printer UEBA dataset |
| UEBA - Unusual Volume of Data Transmitted to Printer per Device by Business Unit - Rule | ML | Base Printer UEBA dataset |
| UEBA - Unusual Volume of Data Transmitted to Printer per Device by Company - Rule | ML | Base Printer UEBA dataset |
| UEBA - Unusual Volume of Data Transmitted to Printer per User | ML | Base Printer UEBA dataset |
| UEBA - Unusual Volume of Data Transmitted to Printer per User by Company - Rule | ML | Base Printer UEBA dataset |
| UEBA - Unusual Volume of Data Uploaded per Device | ML | Network Traffic UEBA Dataset |
| UEBA - Unusual Volume of Data Uploaded per Device by Business Unit | ML | Network Traffic UEBA Dataset |
| UEBA - Unusual Volume of Data Uploaded per Device by Company | ML | Network Traffic UEBA Dataset |
| UEBA - Unusual Volume of Data Uploaded per User | ML | Network Traffic UEBA Dataset |
| UEBA - Unusual Volume Of Data Uploaded Per User By Business Unit | ML | Network Traffic UEBA Dataset |
| UEBA - Unusual Volume of Data Uploaded per User by Company | ML | Network Traffic UEBA Dataset |
| UEBA - Unusual Volume of Data Uploaded To DMZ Devices Per User By Business Unit | ML | Network Traffic UEBA Dataset |
| UEBA - Unusual Volume of Data Uploaded To DMZ Devices Per User By Company | ML | Network Traffic UEBA Dataset |
| UEBA - Unusual Volume Of File Operations To USB Per User | ML | Base USB UEBA Dataset |
| UEBA - Unusual Volume Of File Operations To USB Per User By Company | ML | Base USB UEBA Dataset |
| UEBA - Unusual Volume of Kerberos TGS Ticket Requests | ML | Authentication UEBA Dataset |
| UEBA - Unusual Volume of O365 Login Failures | ML | raw sourcetype supported only (O365) |
| UEBA - Unusual Volume of Okta Login Failures | ML | raw sourcetype supported only (Okta) |
| UEBA - Unusual Volume of Outbound Emails to External Recipients | ML | Email Activity UEBA Dataset |
| UEBA - Unusual Volume of Outgoing Connections per Device | ML | Network Traffic UEBA Dataset |
| UEBA - Unusual Volume of Outgoing Connections per Device by Business Unit | ML | Network Traffic UEBA Dataset |
| UEBA - Unusual Volume of Outgoing Connections Per User | ML | Network Traffic UEBA Dataset |
| UEBA - Unusual Volume of Outgoing Connections Per User By Business Unit | ML | Network Traffic UEBA Dataset |
| UEBA - Unusual Volume of Outgoing Connections Per User By Company | ML | Network Traffic UEBA Dataset |
| UEBA - Unusual Volume of Outgoing Emails to Rare Domains | ML | Email Activity UEBA Dataset |
| UEBA - Unusual Volume of Print per Device | ML | Base Printer UEBA Dataset |
| UEBA - Unusual Volume of Print per Printer | ML | Base Printer UEBA dataset |
| UEBA - Unusual Volume of Print per Printer by Company - Rule | ML | Base Printer UEBA dataset |
| UEBA - Unusual Volume of Print per User | ML | Base Printer UEBA Dataset |
| UEBA - Unusual Volume of Successful Logins | ML | Authentication UEBA Dataset |
| UEBA - Unusual Volume Of USB Denies Per User | ML | Base USB UEBA Dataset |
| UEBA - Unusual Volume Of USB Denies Per User By Company | ML | Base USB UEBA Dataset |
| UEBA - Unusual Volume of VPN Login Failures | ML | raw sourcetype supported only (Palo GlobalProtect) |
| UEBA - WBAdmin Delete System Backups | Streaming | raw sourcetype supported only (Windows) |
| UEBA - WevtUtil Usage To Clear Logs | Streaming | raw sourcetype supported only (Windows) |
| UEBA - Wevtutil Usage To Disable Logs | Streaming | raw sourcetype supported only (Windows) |
| UEBA - Windows Bits Job Persistence | Streaming | raw sourcetype supported only (Windows) |
| UEBA - Windows Bitsadmin Download File | Streaming | raw sourcetype supported only (Windows) |
| UEBA - Windows CertUtil Decode File | Streaming | raw sourcetype supported only (Windows) |
| UEBA - Windows CertUtil URLCache Download | Streaming | raw sourcetype supported only (Windows) |
| UEBA - Windows CertUtil VerifyCtl Download | Streaming | raw sourcetype supported only (Windows) |
| UEBA - Windows COM Hijacking InprocServer32 Modification | ML | raw sourcetype supported only (Windows) |
| UEBA - Windows Curl Upload to Remote Destination | Streaming | raw sourcetype supported only (Windows) |
| UEBA - Windows Default Group Policy Object Modified with GPME | Streaming | raw sourcetype supported only (Windows) |
| UEBA - Windows Defender Tools in Non Standard Path | Streaming | raw sourcetype supported only (Windows) |
| UEBA - Windows Diskshadow Proxy Execution | Streaming | raw sourcetype supported only (Windows) |
| UEBA - Windows DotNet Binary in Non Standard Path | Streaming | raw sourcetype supported only (Windows) |
| UEBA - Windows Exchange PowerShell Module Usage | Streaming | raw sourcetype supported only (Windows) |
| UEBA - Windows Execute Arbitrary Commands with MSDT | Streaming | raw sourcetype supported only (Windows) |
| UEBA - Windows File Share Discovery With Powerview | Streaming | raw sourcetype supported only (Windows) |
| UEBA - Windows Findstr GPP Discovery | Streaming | raw sourcetype supported only (Windows) |
| UEBA - Windows Ingress Tool Transfer Using Explorer | Streaming | raw sourcetype supported only (Windows) |
| UEBA - Windows LOLBin Binary in Non Standard Path | Streaming | raw sourcetype supported only (Windows) |
| UEBA - Windows MSHTA Child Process | Streaming | raw sourcetype supported only (Windows) |
| UEBA - Windows MSHTA Command-Line URL | Streaming | raw sourcetype supported only (Windows) |
| UEBA - Windows MSHTA Inline HTA Execution | Streaming | raw sourcetype supported only (Windows) |
| UEBA - Windows Odbcconf Load Response File | Streaming | raw sourcetype supported only (Windows) |
| UEBA - Windows OS Credential Dumping with Ntdsutil Export NTDS | Streaming | raw sourcetype supported only (Windows) |
| UEBA - Windows OS Credential Dumping with Procdump | Streaming | raw sourcetype supported only (Windows) |
| UEBA - Windows Powershell Connect to Internet With Hidden Window | Streaming | raw sourcetype supported only (Windows) |
| UEBA - Windows PowerShell Disabled Kerberos Pre-Authentication Discovery Get-ADUser | Streaming | raw sourcetype supported only (Windows) |
| UEBA - Windows PowerShell Disabled Kerberos Pre-Authentication Discovery With PowerView | Streaming | raw sourcetype supported only (Windows) |
| UEBA - Windows Powershell DownloadFile | Streaming | raw sourcetype supported only (Windows) |
| UEBA - Windows Powershell DownloadString | Streaming | raw sourcetype supported only (Windows) |
| UEBA - Windows PowerShell Start-BitsTransfer | ML | raw sourcetype supported only (Windows) |
| UEBA - Windows PowerSploit GPP Discovery | Streaming | raw sourcetype supported only (Windows) |
| UEBA - Windows Rasautou DLL Execution | Streaming | raw sourcetype supported only (Windows) |
| UEBA - Windows Rename System Utilities Acccheckconsole exe LOLBAS in Non Standard Path | Streaming | raw sourcetype supported only (Windows) |
| UEBA - Windows Rename System Utilities Adplus exe LOLBAS in Non Standard Path | Streaming | raw sourcetype supported only (Windows) |
| UEBA - Windows Rename System Utilities Advpack dll LOLBAS in Non Standard Path | Streaming | raw sourcetype supported only (Windows) |
| UEBA - Windows Rename System Utilities Agentexecutor exe LOLBAS in Non Standard Path | Streaming | raw sourcetype supported only (Windows) |
| UEBA - Windows Rename System Utilities Appinstaller exe LOLBAS in Non Standard Path | ML | raw sourcetype supported only (Windows) |
| UEBA - Windows Rename System Utilities Appvlp exe LOLBAS in Non Standard Path | Streaming | raw sourcetype supported only (Windows) |
| UEBA - Windows Rename System Utilities Aspnet compiler exe LOLBAS in Non Standard Path | Streaming | raw sourcetype supported only (Windows) |
| UEBA - Windows Rename System Utilities At exe LOLBAS in Non Standard Path | Streaming | raw sourcetype supported only (Windows) |
| UEBA - Windows Rename System Utilities Atbroker exe LOLBAS in Non Standard Path | Streaming | raw sourcetype supported only (Windows) |
| UEBA - Windows Rundll32 Comsvcs Memory Dump | Streaming | raw sourcetype supported only (Windows) |
| UEBA - Windows Rundll32 Inline HTA Execution | ML | raw sourcetype supported only (Windows) |
| UEBA - Windows Screen Capture Via Powershell | Streaming | raw sourcetype supported only (Windows) |
| UEBA - Windows Script Host Spawn MSBuild | Streaming | raw sourcetype supported only (Windows) |
| UEBA - Windows System Binary Proxy Execution Compiled HTML File Decompile | Streaming | raw sourcetype supported only (Windows) |
| UEBA - Windows System Binary Proxy Execution Compiled HTML File URL In Command Line | Streaming | raw sourcetype supported only (Windows) |
| UEBA - Windows System Binary Proxy Execution Compiled HTML File Using InfoTech Storage Handlers | Streaming | raw sourcetype supported only (Windows) |
| UEBA - Windows System Binary Proxy Execution MSIExec DLLRegisterServer | Streaming | raw sourcetype supported only (Windows) |
| UEBA - Windows System Binary Proxy Execution MSIExec Remote Download | Streaming | raw sourcetype supported only (Windows) |
| UEBA - Windows System Binary Proxy Execution MSIExec Unregister DLL | Streaming | raw sourcetype supported only (Windows) |
| UEBA - Windows WMIPrvse Spawn MSBuild | Streaming | raw sourcetype supported only (Windows) |
Detections available with the UEBA Content App for Cloud
Some detections are available only with the UEBA Content App for Cloud (DA-ESS-UEBASecurityContent).
These detections are inactive by default. To activate them, follow the instructions in Verification and setup for the UEBA Content App, especially enabling the summarization searches and detections.