Splunk Security Content

Splunk Threat Reasearch Team (STRT)

We help security teams around the globe strengthen operations by providing tactical guidance and insights to detect, investigate and respond against the latest threats.

Azure Automation Account Created

Create Account, Cloud Account

Azure AD Service Principal Created

Cloud Account

Azure AD Service Principal New Client Credentials

Account Manipulation, Additional Cloud Credentials

Azure AD Global Administrator Role Assigned

Additional Cloud Roles

Linux Csvtool Privilege Escalation

Sudo and Sudo Caching, Abuse Elevation Control Mechanism