Splunk Security Content

Splunk Threat Reasearch Team (STRT)

We help security teams around the globe strengthen operations by providing tactical guidance and insights to detect, investigate and respond against the latest threats.

Hosts receiving high volume of network traffic from email server

Remote Email Collection, Email Collection

Okta User Logins From Multiple Cities

Valid Accounts, Default Accounts

Clients Connecting to Multiple DNS Servers

Exfiltration Over Unencrypted Non-C2 Protocol

Hiding Files And Directories With Attrib exe

File and Directory Permissions Modification, Windows File and Directory Permissions Modification

EC2 Instance Modified With Previously Unseen User

Cloud Accounts