Splunk Security Content

Splunk Threat Reasearch Team (STRT)

We help security teams around the globe strengthen operations by providing tactical guidance and insights to detect, investigate and respond against the latest threats.

Email servers sending high volume traffic to hosts

Email Collection, Remote Email Collection

Hosts receiving high volume of network traffic from email server

Remote Email Collection, Email Collection

Okta User Logins From Multiple Cities

Valid Accounts, Default Accounts

Clients Connecting to Multiple DNS Servers

Exfiltration Over Unencrypted Non-C2 Protocol

Hiding Files And Directories With Attrib exe

File and Directory Permissions Modification, Windows File and Directory Permissions Modification