Splunk

4 posts

• 2026-04-01

  Splunk Threat Hunting: APT Intrusion & Cobalt Strike

  Threat hunting exercise using Splunk to detect APT activity, Cobalt Strike stagers, lateral movement via SMB, and mapped findings to the Cyber Kill Chain.

  Threat HuntingSplunk 6 min read
  →
• 2026-03-29

  Splunk Lab 1 - Brute Force Detection

  Splunk threat hunting lab covering password brute-force detection, attack frequency visualization, IP geolocation, and process execution analysis using BOTSv1 data.

  Threat HuntingDetectionSplunk 2 min read
  →
• 2026-03-29

  Splunk Lab 2 - PowerShell Empire / Lateral Movement / Exfiltration

  Splunk hunting lab covering PowerShell Empire C2 detection, FTP and DNS data exfiltration analysis, adversary infrastructure discovery, and WMI lateral movement using BOTSv2 data.

  Threat HuntingSplunk 8 min read
  →
• 2026-03-29

  Splunk Lab 3 - AD Brute Force, Kerberoasting, Credential Dumping

  Comprehensive Splunk lab covering Active Directory attack detection including brute force, Kerberoasting, credential dumping of lsass.exe, DCSync, and GPP honeypots.

  Threat HuntingSplunk 10 min read
  →