Splunk Threat Research Team Projects

Here's some of the other projects that the Splunk Threat Research Team (STRT) have worked on that you might find interesting:

Splunk Attack Range is a tool that allows you to simulate a cyber attack on your network.

Splunk Attack Data is a collection of data that can be used to simulate a cyber attack on your network.

The Eventlog Compendium is the go-to resource for understanding Windows Event Logs.

Collection of tools and techniques built for Reverse Engineering.

A handcrafted tool to assist in building and analyzing Windows Security Descripter Definition Language (SDDL) strings.

ShellSweep is a tool designed to detect potential web shell files in a specified directory.

A lightweight set of scripts that simulate common NPM supply‑chain attack behaviors in a controlled way.

Blazingly simple, Docker‑first npm supply‑chain scanner.

The ultimate MSIX package creator for security testing, red team exercises, and detection validation.

A comprehensive toolkit for SQL Server security testing, monitoring and web integration with IIS.

This lightweight tool helps you make the most of Splunk’s Security Content metadata in testing.

An MCP (Model Context Protocol) server that lets LLMs query a unified database of security detection rules.