Splunk Security Content

Splunk Threat Reasearch Team (STRT)

We help security teams around the globe strengthen operations by providing tactical guidance and insights to detect, investigate and respond against the latest threats.

Disable Schedule Task

Disable or Modify Tools, Impair Defenses

Impacket Lateral Movement WMIExec Commandline Parameters

Remote Services, SMB/Windows Admin Shares, Distributed Component Object Model, Windows Management Instrumentation, Windows Service

AWS Defense Evasion Delete CloudWatch Log Group

Impair Defenses, Disable or Modify Cloud Logs

Outbound Network Connection from Java Using Default Ports

Exploit Public-Facing Application, External Remote Services

Splunk RCE via Serialized Session Payload

Exploit Public-Facing Application