Splunk Security Content

Splunk Threat Reasearch Team (STRT)

We help security teams around the globe strengthen operations by providing tactical guidance and insights to detect, investigate and respond against the latest threats.

Process Execution via WMI

Windows Management Instrumentation

Windows Archive Collected Data via Rar

Archive via Utility, Archive Collected Data

Azure Active Directory High Risk Sign-in

Compromise Accounts, Cloud Accounts, Brute Force, Password Spraying

PingID Mismatch Auth Source and Verification Response

Multi-Factor Authentication Request Generation, Multi-Factor Authentication, Device Registration

Windows File Without Extension In Critical Folder

Data Destruction