Splunk Security Content

Splunk Threat Reasearch Team (STRT)

We help security teams around the globe strengthen operations by providing tactical guidance and insights to detect, investigate and respond against the latest threats.

Kubernetes newly seen TCP edge

User Execution

Excessive Usage of NSLOOKUP App

Exfiltration Over Alternative Protocol

GetDomainGroup with PowerShell Script Block

Permission Groups Discovery, Domain Groups

Linux Add Files In Known Crontab Directories

Cron, Scheduled Task/Job

Detect WMI Event Subscription Persistence

Windows Management Instrumentation Event Subscription, Event Triggered Execution