Splunk Security Content

Splunk Threat Reasearch Team (STRT)

We help security teams around the globe strengthen operations by providing tactical guidance and insights to detect, investigate and respond against the latest threats.

Rundll32 Process Creating Exe Dll Files

System Binary Proxy Execution, Rundll32

SAM Database File Access Attempt

Security Account Manager, OS Credential Dumping

Detect Copy of ShadowCopy with Script Block Logging

Security Account Manager, OS Credential Dumping

Detect shared ec2 snapshot

Transfer Data to Cloud Account

Mshta spawning Rundll32 OR Regsvr32 Process

System Binary Proxy Execution, Mshta