Splunk Security Content

Splunk Threat Reasearch Team (STRT)

We help security teams around the globe strengthen operations by providing tactical guidance and insights to detect, investigate and respond against the latest threats.

Windows Remote Assistance Spawning Process

Process Injection

Rubeus Kerberos Ticket Exports Through Winlogon Access

Use Alternate Authentication Material, Pass the Ticket

Windows Schtasks Create Run As System

Scheduled Task, Scheduled Task/Job

O365 Bypass MFA via Trusted IP

Disable or Modify Cloud Firewall, Impair Defenses

O365 Disable MFA

Modify Authentication Process