Splunk Security Content

Splunk Threat Reasearch Team (STRT)

We help security teams around the globe strengthen operations by providing tactical guidance and insights to detect, investigate and respond against the latest threats.

Detect Rundll32 Application Control Bypass - advpack

System Binary Proxy Execution, Rundll32

Dump LSASS via procdump Rename

LSASS Memory

Detect Baron Samedit CVE-2021-3156 Segfault

Exploitation for Privilege Escalation

Ntdsutil Export NTDS

NTDS, OS Credential Dumping

Suspicious Regsvr32 Register Suspicious Path

System Binary Proxy Execution, Regsvr32