Splunk Security Content

Splunk Threat Reasearch Team (STRT)

We help security teams around the globe strengthen operations by providing tactical guidance and insights to detect, investigate and respond against the latest threats.

Malicious PowerShell Process - Execution Policy Bypass

Command and Scripting Interpreter, PowerShell

Email files written outside of the Outlook directory

Email Collection, Local Email Collection

Abnormally High AWS Instances Terminated by User

Cloud Accounts

First Time Seen Running Windows Service

System Services, Service Execution

Email servers sending high volume traffic to hosts

Email Collection, Remote Email Collection