Splunk Security Content

Splunk Threat Reasearch Team (STRT)

We help security teams around the globe strengthen operations by providing tactical guidance and insights to detect, investigate and respond against the latest threats.

Suspicious MSBuild Rename

Masquerading, Trusted Developer Utilities Proxy Execution, Rename System Utilities, MSBuild

Windows PowerShell Add Module to Global Assembly Cache

Server Software Component, IIS Components

Windows MSExchange Management Mailbox Cmdlet Usage

Command and Scripting Interpreter, PowerShell

Windows Unsecured Outlook Credentials Access In Registry

Unsecured Credentials

Disable Defender BlockAtFirstSeen Feature

Disable or Modify Tools, Impair Defenses