Splunk Security Content

Splunk Threat Reasearch Team (STRT)

We help security teams around the globe strengthen operations by providing tactical guidance and insights to detect, investigate and respond against the latest threats.

Windows PowerShell IIS Components WebGlobalModule Usage

Server Software Component, IIS Components

Azure AD New Custom Domain Added

Domain or Tenant Policy Modification, Trust Modification

Suspicious Event Log Service Behavior

Indicator Removal, Clear Windows Event Logs

Remote Process Instantiation via WMI and PowerShell Script Block

Windows Management Instrumentation

O365 Mailbox Read Access Granted to Application

Remote Email Collection, Email Collection, Account Manipulation, Additional Cloud Roles