https://www.kirosec.com/ https://www.kirosec.com/pricing https://www.kirosec.com/download https://www.kirosec.com/solutions https://www.kirosec.com/detections https://www.kirosec.com/about https://www.kirosec.com/changelog https://www.kirosec.com/terms https://www.kirosec.com/privacy https://www.kirosec.com/cookies https://www.kirosec.com/solutions/log-analysis-without-ingest-pricing https://www.kirosec.com/solutions/reduce-alert-noise https://www.kirosec.com/solutions/no-server-log-analysis https://www.kirosec.com/solutions/log-analysis-without-a-query-language https://www.kirosec.com/solutions/evidence-you-can-see-and-export https://www.kirosec.com/solutions/one-tool-for-every-log-source https://www.kirosec.com/solutions/microsoft-365-audit-log-investigation https://www.kirosec.com/solutions/client-ready-incident-reports https://www.kirosec.com/solutions/msp-multi-tenant-incident-response https://www.kirosec.com/detections/cloud-aws-cloudtrail-logging-disabled https://www.kirosec.com/detections/cloud-aws-console-login-failure-burst https://www.kirosec.com/detections/cloud-aws-ec2-password-retrieval https://www.kirosec.com/detections/cloud-aws-iam-privilege-escalation https://www.kirosec.com/detections/cloud-aws-kms-mass-decrypt https://www.kirosec.com/detections/cloud-aws-lambda-code-modified https://www.kirosec.com/detections/cloud-aws-network-acl-modified https://www.kirosec.com/detections/cloud-aws-rds-master-password-changed https://www.kirosec.com/detections/cloud-aws-resource-shared-externally https://www.kirosec.com/detections/cloud-aws-root-account-usage https://www.kirosec.com/detections/cloud-aws-s3-public-access https://www.kirosec.com/detections/cloud-aws-security-service-disabled https://www.kirosec.com/detections/cloud-azure-automation-persistence https://www.kirosec.com/detections/cloud-azure-disk-snapshot-export https://www.kirosec.com/detections/cloud-azure-keyvault-secret-harvest https://www.kirosec.com/detections/cloud-azure-marketplace-image-deployed https://www.kirosec.com/detections/cloud-azure-private-endpoint-removed https://www.kirosec.com/detections/cloud-gws-2sv-disabled https://www.kirosec.com/detections/cloud-gws-admin-privilege-granted https://www.kirosec.com/detections/cloud-gws-mfa-unenrolled https://www.kirosec.com/detections/cloud-gws-suspicious-login https://www.kirosec.com/detections/cloud-gws-user-created https://www.kirosec.com/detections/cloud-identity-entra-admin-password-reset https://www.kirosec.com/detections/cloud-identity-entra-app-owner-added https://www.kirosec.com/detections/cloud-identity-entra-confirmed-compromise https://www.kirosec.com/detections/cloud-identity-entra-consent-declined https://www.kirosec.com/detections/cloud-identity-entra-cross-tenant-access-change https://www.kirosec.com/detections/cloud-identity-entra-custom-role-definition-change https://www.kirosec.com/detections/cloud-identity-entra-device-code-signin https://www.kirosec.com/detections/cloud-identity-entra-device-registration-anomaly https://www.kirosec.com/detections/cloud-identity-entra-federated-identity-credential-added https://www.kirosec.com/detections/cloud-identity-entra-graph-directory-enumeration https://www.kirosec.com/detections/cloud-identity-entra-guest-auth-method-change https://www.kirosec.com/detections/cloud-identity-entra-guest-promoted-to-member https://www.kirosec.com/detections/cloud-identity-entra-immutable-id-set https://www.kirosec.com/detections/cloud-identity-entra-legacy-auth-signin https://www.kirosec.com/detections/cloud-identity-entra-offensive-tool-user-agent https://www.kirosec.com/detections/cloud-identity-entra-password-spray https://www.kirosec.com/detections/cloud-identity-entra-prt-replay-failures https://www.kirosec.com/detections/cloud-identity-entra-prt-replay-many-tokens https://www.kirosec.com/detections/cloud-identity-entra-prt-replay-success-after-failures https://www.kirosec.com/detections/cloud-identity-entra-risk-detection https://www.kirosec.com/detections/cloud-identity-entra-risky-signin https://www.kirosec.com/detections/cloud-identity-entra-script-client-signin https://www.kirosec.com/detections/cloud-identity-entra-security-attribute-change https://www.kirosec.com/detections/cloud-identity-entra-session-country-shift https://www.kirosec.com/detections/cloud-identity-entra-session-device-shift https://www.kirosec.com/detections/cloud-identity-entra-session-revocation-bypass https://www.kirosec.com/detections/cloud-identity-entra-signin-brute-force https://www.kirosec.com/detections/cloud-identity-entra-signin-frequency-weakened https://www.kirosec.com/detections/cloud-identity-entra-strong-auth-disabled https://www.kirosec.com/detections/cloud-identity-entra-temporary-access-pass https://www.kirosec.com/detections/cloud-identity-entra-token-exchange-session-shift https://www.kirosec.com/detections/cloud-identity-entra-workload-credential-leaked https://www.kirosec.com/detections/cloud-identity-entra-workload-identity-risk https://www.kirosec.com/detections/cloud-identity-m365-admin-role-grant https://www.kirosec.com/detections/cloud-identity-m365-admin-role-member-removed https://www.kirosec.com/detections/cloud-identity-m365-ai-agent-created https://www.kirosec.com/detections/cloud-identity-m365-app-credential-added https://www.kirosec.com/detections/cloud-identity-m365-app-mailbox-access-many https://www.kirosec.com/detections/cloud-identity-m365-app-permission-escalation https://www.kirosec.com/detections/cloud-identity-m365-app-role-assignment-granted https://www.kirosec.com/detections/cloud-identity-m365-application-impersonation-granted https://www.kirosec.com/detections/cloud-identity-m365-audit-license-downgrade https://www.kirosec.com/detections/cloud-identity-m365-audit-logging-disabled https://www.kirosec.com/detections/cloud-identity-m365-auth-method-registered https://www.kirosec.com/detections/cloud-identity-m365-calendar-contacts-delegated https://www.kirosec.com/detections/cloud-identity-m365-collaboration-invite-lure https://www.kirosec.com/detections/cloud-identity-m365-conditional-access-change https://www.kirosec.com/detections/cloud-identity-m365-distributed-signin-spray https://www.kirosec.com/detections/cloud-identity-m365-domain-federation-change https://www.kirosec.com/detections/cloud-identity-m365-ediscovery-purge https://www.kirosec.com/detections/cloud-identity-m365-ediscovery-search https://www.kirosec.com/detections/cloud-identity-m365-external-sharing-link https://www.kirosec.com/detections/cloud-identity-m365-guest-user-invited https://www.kirosec.com/detections/cloud-identity-m365-high-privilege-consent https://www.kirosec.com/detections/cloud-identity-m365-inactive-mailbox-restored https://www.kirosec.com/detections/cloud-identity-m365-inbox-forwarding-rule https://www.kirosec.com/detections/cloud-identity-m365-inbox-rule-change https://www.kirosec.com/detections/cloud-identity-m365-legacy-protocol-enabled https://www.kirosec.com/detections/cloud-identity-m365-legacy-protocol-mail-access https://www.kirosec.com/detections/cloud-identity-m365-mail-exfil-to-consumer-account https://www.kirosec.com/detections/cloud-identity-m365-mail-lure-delivered https://www.kirosec.com/detections/cloud-identity-m365-mail-outbound-fanout https://www.kirosec.com/detections/cloud-identity-m365-mail-written-directly-to-folder https://www.kirosec.com/detections/cloud-identity-m365-mailbox-access-burst https://www.kirosec.com/detections/cloud-identity-m365-mailbox-audit-retention-reduced https://www.kirosec.com/detections/cloud-identity-m365-mailbox-bulk-sync https://www.kirosec.com/detections/cloud-identity-m365-mailbox-delegation https://www.kirosec.com/detections/cloud-identity-m365-mailbox-export-request https://www.kirosec.com/detections/cloud-identity-m365-mailbox-folder-shared-broadly https://www.kirosec.com/detections/cloud-identity-m365-mailbox-hiding-rule https://www.kirosec.com/detections/cloud-identity-m365-mailbox-mass-delete https://www.kirosec.com/detections/cloud-identity-m365-mailbox-region-moved https://www.kirosec.com/detections/cloud-identity-m365-mailbox-search-targeting https://www.kirosec.com/detections/cloud-identity-m365-malicious-oauth-app https://www.kirosec.com/detections/cloud-identity-m365-mass-download https://www.kirosec.com/detections/cloud-identity-m365-mass-user-deletion https://www.kirosec.com/detections/cloud-identity-m365-mfa-fatigue https://www.kirosec.com/detections/cloud-identity-m365-mfa-policy-changed https://www.kirosec.com/detections/cloud-identity-m365-microsoft-native-alert https://www.kirosec.com/detections/cloud-identity-m365-oauth-consent-grant https://www.kirosec.com/detections/cloud-identity-m365-outbound-connector-rerouting https://www.kirosec.com/detections/cloud-identity-m365-password-spray-audit-log https://www.kirosec.com/detections/cloud-identity-m365-payment-mail-hiding-rule https://www.kirosec.com/detections/cloud-identity-m365-phishing-reports-burst https://www.kirosec.com/detections/cloud-identity-m365-power-automate-mail-flow https://www.kirosec.com/detections/cloud-identity-m365-purview-policy-tampering https://www.kirosec.com/detections/cloud-identity-m365-scripted-sharepoint-access https://www.kirosec.com/detections/cloud-identity-m365-search-export-downloaded https://www.kirosec.com/detections/cloud-identity-m365-send-as-burst https://www.kirosec.com/detections/cloud-identity-m365-send-as-impersonation https://www.kirosec.com/detections/cloud-identity-m365-sensitive-folder-staging https://www.kirosec.com/detections/cloud-identity-m365-sensitive-repository-search https://www.kirosec.com/detections/cloud-identity-m365-service-principal-added https://www.kirosec.com/detections/cloud-identity-m365-smtp-forwarding https://www.kirosec.com/detections/cloud-identity-m365-teams-meeting-join-loop https://www.kirosec.com/detections/cloud-identity-m365-teams-payload-distribution https://www.kirosec.com/detections/cloud-identity-m365-transport-agent-installed https://www.kirosec.com/detections/cloud-identity-m365-transport-rule https://www.kirosec.com/detections/cloud-identity-m365-transport-rule-reordered https://www.kirosec.com/detections/cloud-identity-m365-user-consent-policy-weakened https://www.kirosec.com/detections/cloud-identity-mfa-disabled-then-signin https://www.kirosec.com/detections/cloud-identity-okta-mfa-push-bombing https://www.kirosec.com/detections/cloud-identity-okta-session-ip-hop https://www.kirosec.com/detections/cloud-identity-signin-error-burst-from-source https://www.kirosec.com/detections/cloud-identity-signin-many-source-ips https://www.kirosec.com/detections/cloud-identity-signin-success https://www.kirosec.com/detections/cloud-identity-signin-user-agent-rotation https://www.kirosec.com/detections/cloud-identity-user-new-source-ip-baseline https://www.kirosec.com/detections/cloud-okta-account-lockouts https://www.kirosec.com/detections/cloud-okta-admin-privilege-granted https://www.kirosec.com/detections/cloud-okta-anonymizing-proxy-signin https://www.kirosec.com/detections/cloud-okta-api-token-created https://www.kirosec.com/detections/cloud-okta-device-enrolled https://www.kirosec.com/detections/cloud-okta-identity-provider-change https://www.kirosec.com/detections/cloud-okta-mfa-deactivated https://www.kirosec.com/detections/cloud-okta-security-policy-deactivated https://www.kirosec.com/detections/cloud-okta-threat-detected https://www.kirosec.com/detections/cloud-okta-unauthorized-app-access https://www.kirosec.com/detections/cloud-okta-user-reported-suspicious-activity https://www.kirosec.com/detections/execution-dual-use-admin-tool https://www.kirosec.com/detections/execution-known-offensive-tool https://www.kirosec.com/detections/exfiltration-cloud-upload-service https://www.kirosec.com/detections/linux-account-user-added https://www.kirosec.com/detections/linux-credential-access-credential-file-search https://www.kirosec.com/detections/linux-credential-access-sensitive-file-read https://www.kirosec.com/detections/linux-defense-evasion-audit-daemon-stopped https://www.kirosec.com/detections/linux-defense-evasion-file-attribute-tampering https://www.kirosec.com/detections/linux-defense-evasion-history-tampering https://www.kirosec.com/detections/linux-defense-evasion-security-service-stopped https://www.kirosec.com/detections/linux-execution-ld-preload-injection https://www.kirosec.com/detections/linux-execution-reverse-shell https://www.kirosec.com/detections/linux-execution-reverse-shell-auditd https://www.kirosec.com/detections/linux-impact-destructive-file-wipe https://www.kirosec.com/detections/linux-persistence-at-job-scheduled https://www.kirosec.com/detections/linux-persistence-cron-job-added https://www.kirosec.com/detections/linux-persistence-kernel-module-loaded https://www.kirosec.com/detections/linux-persistence-ld-preload-file-modified https://www.kirosec.com/detections/linux-persistence-shell-profile-modified https://www.kirosec.com/detections/linux-persistence-ssh-authorized-keys-written https://www.kirosec.com/detections/linux-persistence-ssh-config-modified https://www.kirosec.com/detections/linux-persistence-systemd-service-created https://www.kirosec.com/detections/linux-privilege-doas-config-modified https://www.kirosec.com/detections/linux-privilege-setuid-bit-set https://www.kirosec.com/detections/linux-privilege-sudo-failure-burst https://www.kirosec.com/detections/linux-privilege-sudoers-modified https://www.kirosec.com/detections/linux-ssh-brute-force-repeated-failures https://www.kirosec.com/detections/linux-ssh-logon-success https://www.kirosec.com/detections/macos-credential-access-keychain-credential-dump https://www.kirosec.com/detections/macos-defense-evasion-gatekeeper-disabled https://www.kirosec.com/detections/macos-defense-evasion-quarantine-removed https://www.kirosec.com/detections/macos-execution-curl-pipe-to-shell https://www.kirosec.com/detections/macos-execution-dyld-insert-libraries https://www.kirosec.com/detections/macos-execution-osascript-abuse https://www.kirosec.com/detections/macos-lateral-remote-access-enabled https://www.kirosec.com/detections/macos-persistence-launchd-item-registered https://www.kirosec.com/detections/macos-persistence-launchd-malicious-plist https://www.kirosec.com/detections/macos-persistence-launchd-suspicious-program https://www.kirosec.com/detections/macos-privilege-escalation-admin-rights-granted https://www.kirosec.com/detections/multi-authentication-distributed-password-spray https://www.kirosec.com/detections/multi-authentication-failed-logon-burst https://www.kirosec.com/detections/multi-authentication-mfa-denied-then-approved https://www.kirosec.com/detections/multi-defense-evasion-security-log-cleared https://www.kirosec.com/detections/multi-persistence-new-account-created https://www.kirosec.com/detections/network-c2-dns-tunneling https://www.kirosec.com/detections/network-discovery-host-sweep-from-source https://www.kirosec.com/detections/network-discovery-port-sweep-from-source https://www.kirosec.com/detections/network-suspicious-c2-port https://www.kirosec.com/detections/policy-anonymizer-usage https://www.kirosec.com/detections/sigma-azure-activity-logs-azure-creating-number-of-resources-detection https://www.kirosec.com/detections/sigma-azure-activity-logs-azure-device-or-configuration-modified-or-deleted https://www.kirosec.com/detections/sigma-azure-activity-logs-azure-granting-permission-detection https://www.kirosec.com/detections/sigma-azure-activity-logs-azure-rare-operations https://www.kirosec.com/detections/sigma-azure-audit-logs-azure-aad-secops-ca-policy-removedby-bad-actor https://www.kirosec.com/detections/sigma-azure-audit-logs-azure-aad-secops-ca-policy-updatedby-bad-actor https://www.kirosec.com/detections/sigma-azure-audit-logs-azure-aad-secops-new-ca-policy-addedby-bad-actor https://www.kirosec.com/detections/sigma-azure-audit-logs-azure-app-appid-uri-changes https://www.kirosec.com/detections/sigma-azure-audit-logs-azure-app-credential-added https://www.kirosec.com/detections/sigma-azure-audit-logs-azure-app-delegated-permissions-all-users https://www.kirosec.com/detections/sigma-azure-audit-logs-azure-app-owner-added https://www.kirosec.com/detections/sigma-azure-audit-logs-azure-app-permissions-msft https://www.kirosec.com/detections/sigma-azure-audit-logs-azure-app-privileged-permissions https://www.kirosec.com/detections/sigma-azure-audit-logs-azure-app-uri-modifications https://www.kirosec.com/detections/sigma-azure-audit-logs-azure-group-user-addition-ca-modification https://www.kirosec.com/detections/sigma-azure-audit-logs-azure-group-user-removal-ca-modification https://www.kirosec.com/detections/sigma-azure-audit-logs-azure-pim-activation-approve-deny https://www.kirosec.com/detections/sigma-azure-audit-logs-azure-pim-alerts-disabled https://www.kirosec.com/detections/sigma-azure-audit-logs-azure-pim-change-settings https://www.kirosec.com/detections/sigma-azure-audit-logs-azure-priviledged-role-assignment-add https://www.kirosec.com/detections/sigma-azure-audit-logs-azure-priviledged-role-assignment-bulk-change https://www.kirosec.com/detections/sigma-azure-signin-logs-azure-app-device-code-authentication https://www.kirosec.com/detections/sigma-azure-signin-logs-azure-app-ropc-authentication https://www.kirosec.com/detections/sigma-bcdedit-recovery-tamper https://www.kirosec.com/detections/sigma-bitsadmin-transfer https://www.kirosec.com/detections/sigma-certutil-download-decode https://www.kirosec.com/detections/sigma-credential-dumping-tools-1 https://www.kirosec.com/detections/sigma-credential-dumping-tools-2 https://www.kirosec.com/detections/sigma-encoded-powershell-command https://www.kirosec.com/detections/sigma-fsutil-usn-delete https://www.kirosec.com/detections/sigma-linux-download-and-exec https://www.kirosec.com/detections/sigma-mshta-remote-payload https://www.kirosec.com/detections/sigma-net-local-account-creation https://www.kirosec.com/detections/sigma-net-localgroup-admin-add https://www.kirosec.com/detections/sigma-netsh-portproxy https://www.kirosec.com/detections/sigma-nltest-domain-enumeration https://www.kirosec.com/detections/sigma-odbcconf-response-file-exec https://www.kirosec.com/detections/sigma-office-spawns-interpreter https://www.kirosec.com/detections/sigma-powershell-defender-exclusion https://www.kirosec.com/detections/sigma-powershell-download-cradle https://www.kirosec.com/detections/sigma-psexec-service-exec https://www.kirosec.com/detections/sigma-reg-add-run-key https://www.kirosec.com/detections/sigma-registry-sam-hive-dump-via-reg-save https://www.kirosec.com/detections/sigma-regsvr32-scriptlet-exec https://www.kirosec.com/detections/sigma-rundll32-javascript-execution https://www.kirosec.com/detections/sigma-scheduled-task-creation-via-schtasks https://www.kirosec.com/detections/sigma-shadow-copy-deletion-via-vssadmin https://www.kirosec.com/detections/sigma-whoami-execution https://www.kirosec.com/detections/sigma-windows-event-log-cleared-via-wevtutil https://www.kirosec.com/detections/sigma-wmic-process-call-create https://www.kirosec.com/detections/web-access-sensitive-path https://www.kirosec.com/detections/web-attack-exploit-succeeded https://www.kirosec.com/detections/web-attack-suspicious-request https://www.kirosec.com/detections/web-recon-http-error-burst https://www.kirosec.com/detections/windows-account-added-to-administrators https://www.kirosec.com/detections/windows-account-user-created https://www.kirosec.com/detections/windows-audit-security-log-cleared https://www.kirosec.com/detections/windows-auth-failed-logon-burst https://www.kirosec.com/detections/windows-auth-logon-success https://www.kirosec.com/detections/windows-auth-mssql-failed-logon-burst https://www.kirosec.com/detections/windows-auth-rdp-remote-login https://www.kirosec.com/detections/windows-c2-bits-transfer-by-user-account https://www.kirosec.com/detections/windows-c2-rdp-logon-from-loopback https://www.kirosec.com/detections/windows-c2-ssh-port-forward-tunnel https://www.kirosec.com/detections/windows-c2-web-server-internal-service-connection https://www.kirosec.com/detections/windows-collection-archive-staging https://www.kirosec.com/detections/windows-credential-asrep-roasting https://www.kirosec.com/detections/windows-credential-dcsync https://www.kirosec.com/detections/windows-credential-dsrm-password-change https://www.kirosec.com/detections/windows-credential-iis-configuration-credential-dump https://www.kirosec.com/detections/windows-credential-keepass-remote-thread https://www.kirosec.com/detections/windows-credential-kerberoasting https://www.kirosec.com/detections/windows-credential-kerberoasting-spn-sweep https://www.kirosec.com/detections/windows-credential-lolbin-process-memory-dump https://www.kirosec.com/detections/windows-credential-lsa-secrets-access https://www.kirosec.com/detections/windows-credential-lsass-access https://www.kirosec.com/detections/windows-credential-lsass-dump https://www.kirosec.com/detections/windows-credential-lsass-named-pipe-access https://www.kirosec.com/detections/windows-credential-lsass-object-access https://www.kirosec.com/detections/windows-credential-ntlm-network-logon https://www.kirosec.com/detections/windows-credential-powershell-credential-dumping https://www.kirosec.com/detections/windows-credential-sam-hive-direct-modification https://www.kirosec.com/detections/windows-defense-evasion-attrib-hide-file https://www.kirosec.com/detections/windows-defense-evasion-kernel-integrity-weakened https://www.kirosec.com/detections/windows-defense-evasion-mssql-xp-cmdshell-enabled https://www.kirosec.com/detections/windows-defense-evasion-security-logging-registry-tampering https://www.kirosec.com/detections/windows-defense-evasion-system-binary-masquerading https://www.kirosec.com/detections/windows-defense-evasion-termservice-servicedll-hijack https://www.kirosec.com/detections/windows-discovery-ad-recon https://www.kirosec.com/detections/windows-discovery-privileged-group-enumeration https://www.kirosec.com/detections/windows-discovery-remote-enumeration-pipe https://www.kirosec.com/detections/windows-execution-control-panel-applet-from-user-path https://www.kirosec.com/detections/windows-execution-database-process-spawned-shell https://www.kirosec.com/detections/windows-execution-lolbin-application-launcher https://www.kirosec.com/detections/windows-execution-lolbin-download https://www.kirosec.com/detections/windows-execution-rundll32-lolbin-proxy https://www.kirosec.com/detections/windows-execution-scriptlet-from-remote-url https://www.kirosec.com/detections/windows-execution-unsigned-dll-from-scratch-dir https://www.kirosec.com/detections/windows-execution-wmic-remote-xsl-format https://www.kirosec.com/detections/windows-exfiltration-removable-media-mounted https://www.kirosec.com/detections/windows-firewall-rule-changed https://www.kirosec.com/detections/windows-impact-mass-file-deletion https://www.kirosec.com/detections/windows-impact-shadow-copy-deletion https://www.kirosec.com/detections/windows-injection-remote-thread-from-scratch-dir https://www.kirosec.com/detections/windows-injection-remote-thread-into-system-process https://www.kirosec.com/detections/windows-injection-unbacked-call-trace-process-access https://www.kirosec.com/detections/windows-lateral-suspicious-named-pipe https://www.kirosec.com/detections/windows-lateral-wmic-process-call https://www.kirosec.com/detections/windows-lateral-movement-admin-share-executable-write https://www.kirosec.com/detections/windows-lateral-movement-admin-share-remote-exec-pipe https://www.kirosec.com/detections/windows-lateral-movement-netsh-portproxy https://www.kirosec.com/detections/windows-lateral-movement-network-share-created https://www.kirosec.com/detections/windows-lateral-movement-tsclient-share-execution https://www.kirosec.com/detections/windows-lateral-movement-winrm-remote-command https://www.kirosec.com/detections/windows-persistence-autostart-registry-hijack https://www.kirosec.com/detections/windows-persistence-com-object-hijack https://www.kirosec.com/detections/windows-persistence-hidden-local-account https://www.kirosec.com/detections/windows-persistence-kernel-driver-service-installed https://www.kirosec.com/detections/windows-persistence-run-key-modified https://www.kirosec.com/detections/windows-persistence-scheduled-task-created https://www.kirosec.com/detections/windows-persistence-scheduled-task-self-deleted https://www.kirosec.com/detections/windows-persistence-service-installed https://www.kirosec.com/detections/windows-persistence-startup-folder-executable-write https://www.kirosec.com/detections/windows-persistence-wmi-event-subscription https://www.kirosec.com/detections/windows-powershell-download-cradle https://www.kirosec.com/detections/windows-powershell-encoded-command https://www.kirosec.com/detections/windows-powershell-hidden-window https://www.kirosec.com/detections/windows-powershell-obfuscated-command-classic-channel https://www.kirosec.com/detections/windows-powershell-obfuscated-scriptblock https://www.kirosec.com/detections/windows-privilege-abuse-rapid-group-membership-changes https://www.kirosec.com/detections/windows-privilege-escalation-autoelevate-parent-spawned-shell https://www.kirosec.com/detections/windows-privilege-escalation-autoelevated-task-or-installer-abuse https://www.kirosec.com/detections/windows-privilege-escalation-cmstp-inf-execution https://www.kirosec.com/detections/windows-privilege-escalation-uac-bypass-shell-open-hijack https://www.kirosec.com/detections/windows-privilege-escalation-wusa-extract-to-system-directory https://www.kirosec.com/detections/windows-process-office-spawns-shell https://www.kirosec.com/detections/windows-remote-access-rmm-tool-install https://www.kirosec.com/detections/windows-security-control-defender-tampering https://www.kirosec.com/detections/windows-security-control-security-service-stopped