Splunk Security Content

Splunk Threat Reasearch Team (STRT)

We help security teams around the globe strengthen operations by providing tactical guidance and insights to detect, investigate and respond against the latest threats.

Suspicious IcedID Rundll32 Cmdline

System Binary Proxy Execution, Rundll32

GetWmiObject User Account with PowerShell

Account Discovery, Local Account

Creation of lsass Dump with Taskmgr

LSASS Memory, OS Credential Dumping

Windows Modify Registry ProxyEnable

Modify Registry

Zscaler Potentially Abused File Download

Phishing