Splunk Security Content

Splunk Threat Reasearch Team (STRT)

We help security teams around the globe strengthen operations by providing tactical guidance and insights to detect, investigate and respond against the latest threats.

Linux File Creation In Init Boot Directory

RC Scripts, Boot or Logon Initialization Scripts

Windows AppLocker Rare Application Launch Detection

System Binary Proxy Execution

Suspicious Rundll32 StartW

System Binary Proxy Execution, Rundll32

Impacket Lateral Movement Commandline Parameters

Remote Services, SMB/Windows Admin Shares, Distributed Component Object Model, Windows Management Instrumentation, Windows Service

Windows Account Discovery for Sam Account Name

Account Discovery