Splunk Security Content

Splunk Threat Reasearch Team (STRT)

We help security teams around the globe strengthen operations by providing tactical guidance and insights to detect, investigate and respond against the latest threats.

CMD Carry Out String Command Parameter

Windows Command Shell, Command and Scripting Interpreter

Schedule Task with HTTP Command Arguments

Scheduled Task/Job

Any Powershell DownloadString

Command and Scripting Interpreter, PowerShell, Ingress Tool Transfer

Windows DNS Gather Network Info

DNS

WinEvent Scheduled Task Created to Spawn Shell

Scheduled Task, Scheduled Task/Job