Splunk Security Content

Splunk Threat Reasearch Team (STRT)

We help security teams around the globe strengthen operations by providing tactical guidance and insights to detect, investigate and respond against the latest threats.

Suspicious MSBuild Rename

Masquerading, Trusted Developer Utilities Proxy Execution, Rename System Utilities, MSBuild

Windows MSExchange Management Mailbox Cmdlet Usage

Command and Scripting Interpreter, PowerShell

Windows Modify Registry LongPathsEnabled

Modify Registry

Rundll32 with no Command Line Arguments with Network

System Binary Proxy Execution, Rundll32

Exchange PowerShell Module Usage