Splunk Security Content

Splunk Threat Reasearch Team (STRT)

We help security teams around the globe strengthen operations by providing tactical guidance and insights to detect, investigate and respond against the latest threats.

Detect AWS Console Login by User from New City

Compromise Accounts, Cloud Accounts, Unused/Unsupported Cloud Regions

Windows Possible Credential Dumping

LSASS Memory, OS Credential Dumping

Windows Access Token Manipulation Winlogon Duplicate Token Handle

Token Impersonation/Theft, Access Token Manipulation

Windows Service Deletion In Registry

Service Stop

Windows Access Token Winlogon Duplicate Handle In Uncommon Path