Splunk Security Content

Splunk Threat Reasearch Team (STRT)

We help security teams around the globe strengthen operations by providing tactical guidance and insights to detect, investigate and respond against the latest threats.

Shim Database Installation With Suspicious Parameters

Application Shimming, Event Triggered Execution

Monitor Registry Keys for Print Monitors

Port Monitors, Boot or Logon Autostart Execution

Execution of File with Multiple Extensions

Masquerading, Rename System Utilities

Disabling Remote User Account Control

Bypass User Account Control, Abuse Elevation Control Mechanism

Detect Prohibited Applications Spawning cmd exe

Command and Scripting Interpreter, Windows Command Shell