Splunk Security Content

Splunk Threat Reasearch Team (STRT)

We help security teams around the globe strengthen operations by providing tactical guidance and insights to detect, investigate and respond against the latest threats.

Recon AVProduct Through Pwh or WMI

Gather Victim Host Information

Print Processor Registry Autostart

Print Processors, Boot or Logon Autostart Execution

Wscript Or Cscript Suspicious Child Process

Process Injection, Create or Modify System Process, Parent PID Spoofing, Access Token Manipulation

Any Powershell DownloadFile

Command and Scripting Interpreter, PowerShell, Ingress Tool Transfer

Windows Deleted Registry By A Non Critical Process File Path

Modify Registry