Splunk Security Content

Splunk Threat Reasearch Team (STRT)

We help security teams around the globe strengthen operations by providing tactical guidance and insights to detect, investigate and respond against the latest threats.

Windows Default Group Policy Object Modified

Domain Policy Modification, Group Policy Modification

Windows PowerShell Get CIMInstance Remote Computer

PowerShell

Windows Special Privileged Logon On Multiple Hosts

Account Discovery, SMB/Windows Admin Shares, Network Share Discovery

Windows PowerShell WMI Win32 ScheduledJob

PowerShell, Command and Scripting Interpreter

Windows Group Policy Object Created

Domain Policy Modification, Group Policy Modification, Domain Accounts