Splunk Security Content

Splunk Threat Reasearch Team (STRT)

We help security teams around the globe strengthen operations by providing tactical guidance and insights to detect, investigate and respond against the latest threats.

Malicious PowerShell Process - Execution Policy Bypass

Command and Scripting Interpreter , PowerShell

Hosts receiving high volume of network traffic from email server

Remote Email Collection , Email Collection

Hiding Files And Directories With Attrib exe

File and Directory Permissions Modification , Windows File and Directory Permissions Modification

First Time Seen Running Windows Service

System Services , Service Execution

First time seen command line argument

PowerShell , Windows Command Shell