Splunk Security Content

Splunk Threat Reasearch Team (STRT)

We help security teams around the globe strengthen operations by providing tactical guidance and insights to detect, investigate and respond against the latest threats.

Detect Use of cmd exe to Launch Script Interpreters

Command and Scripting Interpreter, Windows Command Shell

Splunk Information Disclosure in Splunk Add-on Builder

System Information Discovery

SearchProtocolHost with no Command Line with Network

Process Injection

WinEvent Windows Task Scheduler Event Action Started

Scheduled Task

WMI Permanent Event Subscription - Sysmon

Windows Management Instrumentation Event Subscription, Event Triggered Execution