Splunk Security Content

Splunk Threat Reasearch Team (STRT)

We help security teams around the globe strengthen operations by providing tactical guidance and insights to detect, investigate and respond against the latest threats.

Rundll32 LockWorkStation

System Binary Proxy Execution, Rundll32

Creation of Shadow Copy

NTDS, OS Credential Dumping

Non Firefox Process Access Firefox Profile Dir

Credentials from Password Stores, Credentials from Web Browsers

Detect S3 access from a new IP

Data from Cloud Storage

Linux High Frequency Of File Deletion In Boot Folder

Data Destruction, File Deletion, Indicator Removal