Splunk Security Content

Splunk Threat Reasearch Team (STRT)

We help security teams around the globe strengthen operations by providing tactical guidance and insights to detect, investigate and respond against the latest threats.

Detect Prohibited Applications Spawning cmd exe

Command and Scripting Interpreter

Excessive distinct processes from Windows Temp

Command and Scripting Interpreter

ServicePrincipalNames Discovery with PowerShell

Kerberoasting

Detect Mimikatz With PowerShell Script Block Logging

OS Credential Dumping, PowerShell

Get-ForestTrust with PowerShell Script Block

Domain Trust Discovery, PowerShell