Splunk Security Content

Splunk Threat Reasearch Team (STRT)

We help security teams around the globe strengthen operations by providing tactical guidance and insights to detect, investigate and respond against the latest threats.

Create or delete windows shares using net exe

Indicator Removal, Network Share Connection Removal

Detect HTML Help Spawn Child Process

System Binary Proxy Execution, Compiled HTML File

Winword Spawning Cmd

Phishing, Spearphishing Attachment

Windows Rasautou DLL Execution

Dynamic-link Library Injection, System Binary Proxy Execution, Process Injection

Attempt To Add Certificate To Untrusted Store

Install Root Certificate, Subvert Trust Controls