Skip to content
Threat Feed

Tag

Attacker-Tool

1 brief RSS
high advisory

Detection of Attacker Tools on Endpoints

This analytic detects the execution of attacker tools used for unauthorized access, network scanning, privilege escalation, password dumping, or data exfiltration, based on process activity data from EDR agents and focusing on known attacker tool names.

Splunk Enterprise +3 attacker-tool endpoint privilege-escalation data-exfiltration
2r 3t