Siemphony

Systemctl invoked with a state-changing service subcommand

Systemd timer enabled or scheduled from the command line

Systemd unit file written under a unit search path on Linux

Terminal Services ServiceDll registry value modified

Transport agent installed or enabled on a mail server

Trap command written into a shell startup file

Udev rule file written in a udev rules directory on Linux

Uncommon process connects to an internal host on a relay port

Unexpected child process of winlogon.exe or userinit.exe

Unexpected child process spawned by msiexec.exe

Unix shell spawned by a network-facing service daemon

Unsigned DLL loaded into LSASS as a notification package

Unsigned kernel driver loaded

Unsigned module loaded into a hybrid identity agent process

User account created from a SYSTEM or machine account context

User account marked hidden in the Windows SpecialAccounts UserList

Utility executing under a name its own PE metadata contradicts

VBScript or legacy Visual Basic runtime loaded into a process

0% noise measured in lab

VBScript or scriptlet engine loaded into Outlook

Verclsid spawned by an Office application or script host

VirtualBox or VMware VM started headless from the command line

Visual Studio Code CLI starting a remote tunnel

Web server worker writes a server-side script into a web root

Webhook endpoint domain resolved by a script host or transfer tool