Splunk Security Content

Splunk Threat Reasearch Team (STRT)

We help security teams around the globe strengthen operations by providing tactical guidance and insights to detect, investigate and respond against the latest threats.

Disable Schedule Task

Disable or Modify Tools, Impair Defenses

ServicePrincipalNames Discovery with SetSPN

Kerberoasting

Suspicious wevtutil Usage

Clear Windows Event Logs, Indicator Removal

Executables Or Script Creation In Suspicious Path

Masquerading

Sdelete Application Execution

Data Destruction, File Deletion, Indicator Removal