Splunk Security Content

Splunk Threat Reasearch Team (STRT)

We help security teams around the globe strengthen operations by providing tactical guidance and insights to detect, investigate and respond against the latest threats.

First time seen command line argument

PowerShell, Windows Command Shell

Malicious PowerShell Process - Execution Policy Bypass

Command and Scripting Interpreter, PowerShell

Email files written outside of the Outlook directory

Email Collection, Local Email Collection

Abnormally High AWS Instances Terminated by User

Cloud Accounts

First Time Seen Running Windows Service

System Services, Service Execution