Splunk Security Content

Splunk Threat Reasearch Team (STRT)

We help security teams around the globe strengthen operations by providing tactical guidance and insights to detect, investigate and respond against the latest threats.

O365 Suspicious Admin Email Forwarding

Email Forwarding Rule, Email Collection

High Number of Login Failures from a single source

Password Guessing, Brute Force

O365 PST export alert

Email Collection

O365 Suspicious Rights Delegation

Remote Email Collection, Email Collection

Sunburst Correlation DLL and Network Event

Exploitation for Client Execution