In this blog post we'll look closely at the WINELOADER backdoor and how Splunk can be used to detect and respond to this threat.

Advanced Threat Prevention (ATP) is a suite of analysis tools designed to defend against advanced threats that use known and unknown attack vectors.

I recently got a question from our field inquiring about the minimum vSphere privileges that would be required to either install or remove a patch (VIB/Component) from an ESXi host. The customer wa…

Find security advisories for VMware products.

In this blog, the Splunk Threat Research Team provides valuable insights to enable security analysts and blue teamers to defend and be aware of these scam tactics.

Two rounds of reports and patches may not have completely closed this hole

After writing and peer-reviewing numerous SIEM searches, here I share some tips to help others enhance their query-foo.

AitM attacks involve threat actors eavesdropping, intercepting, or manipulating data traffic before actively engaging or hijacking.

Upgraded Detections, New Analytic Format, & Cross-Domain Adversary Insights

CVE cache of the official CVE List in CVE JSON 5 format - CVEProject/cvelistV5

In this post we will cover the basics of Event Logging in Linux systems. We will talk about Syslog: Message structure, the most famous implementations and main configurations.

And How to Use It to Identify Malicious Traffic

Introduction

In this blog post, we will cover how we have incorporated the Golden Certificates and the ADCS ESC3 abuse technique in BloodHound.

View announcements and review known issues and fixes for Windows Server 2022