Splunk Security Content

Splunk Threat Reasearch Team (STRT)

We help security teams around the globe strengthen operations by providing tactical guidance and insights to detect, investigate and respond against the latest threats.

Hosts receiving high volume of network traffic from email server

Remote Email Collection , Email Collection

Hiding Files And Directories With Attrib exe

File and Directory Permissions Modification , Windows File and Directory Permissions Modification

First Time Seen Running Windows Service

System Services , Service Execution

First time seen command line argument

PowerShell , Windows Command Shell

Excessive DNS Failures

DNS , Application Layer Protocol