Splunk Security Content

Splunk Threat Reasearch Team (STRT)

We help security teams around the globe strengthen operations by providing tactical guidance and insights to detect, investigate and respond against the latest threats.

Detect Certify With PowerShell Script Block Logging

Steal or Forge Authentication Certificates, Command and Scripting Interpreter, PowerShell

Detect Certify Command Line Arguments

Steal or Forge Authentication Certificates, Ingress Tool Transfer

VMWare Aria Operations Exploit Attempt

External Remote Services, Exploit Public-Facing Application, Exploitation of Remote Services, Exploitation for Privilege Escalation

Windows System Shutdown CommandLine

System Shutdown/Reboot

Windows Powershell RemoteSigned File

PowerShell, Command and Scripting Interpreter