Splunk Threat Research Lead on Threat Hunting, Detection Engineering and Living-Off-the-Land Risks
Summary
Splunk’s Jose Hernandez discusses detection engineering, threat hunting, infrastructure analysis, and efforts to help defenders address attackers’ abuse of legitimate tools.
Key points
- Splunk’s threat research team simulates attacks and uses a detection-as-code workflow with automated testing to build SIEM detections.
- Hernandez identifies actionable alerts, limiting false positives, and validating detections across varied environments as key challenges.
- He recommends learning what normal activity looks like, following curious leads, and automating routine triage while keeping humans involved in analysis.
- Hernandez describes using Hunt.io to investigate suspicious infrastructure; one example uncovered 18 additional domains targeting regional energy companies.
- The MagicSword collective catalogs legitimate tools abused in attacks, including drivers and remote-management software, to help defenders address living-off-the-land activity.
- The group is researching focused application control based on tools used in real attacks; Hernandez says early testing across more than 1,000 endpoints showed promising results.
Article Details
- Topic
- Threat hunting and detection workflows, Hunt.io’s role in infrastructure investigations, and MagicSword’s research into living-off-the-land threats.
People
Vendors
CyberArkLook at technologies like Windows Defender Application Control (WDAC) or vendors like ThreatLocker, CyberArk, and others that take the approach of "learn everything, block everything else". They'll spend weeks orHunt.iodetections that matter, how he spots emerging threats before they hit the headlines, and how tools like Hunt.io and MagicSword are helping defenders shift from reactive to strategic. He also talks about work-lifeSplunkJose Hernandez knows that mindset well. He leads Splunk's Threat Research Team, where he and his team simulate attacks, build detections, and constantly test their ideas against what real attackers are doing. Outside ofThreatLockerterribly. Look at technologies like Windows Defender Application Control (WDAC) or vendors like ThreatLocker, CyberArk, and others that take the approach of "learn everything, block everything else". They'll
Products
Splunk Enterprise SecurityJose: The team's objective and role in short is to ship content for the Splunk Enterprise Security SIEM product. Although easier said than described, since this really entails many things. We are responsible forWindows Defender Application Control (WDAC)control, but honestly, it's implemented terribly. Look at technologies like Windows Defender Application Control (WDAC) or vendors like ThreatLocker, CyberArk, and others that take the approach of "learn
Tools
ANY.RUNmultiple blogs, that's my cue to start building hunts. Same with sandboxes like Malware Bazaar and ANY.RUN if hundreds of researchers are suddenly analyzing a particular family, or it shows up in their top 10Atomic Red TeamSimulate the attack (heavy emphasis on Atomic Red Team), testing stuffCapAttackof uniting both products' detection stockpile. We specifically are now using or looking to use their CapAttack (attack capturing) tool inside the Splunk Attack Range to have better data captures during our attackCymrufor context, so I'd rather have one enriched indicator than 50 raw IP addresses. Tools like GreyNoise and Cymru save us from chasing scanner noise, while Hunt.io is perfect for drilling down on infrastructure that'sFeedly"automate the boring stuff so humans can do the interesting stuff." I recently started (and love) using Feedly to track what's actually trending, not just what vendors are hyping, but what researchers are genuinelyGitHub ActionsWhere it is automatically linted and tested via our CI pipeline, leveraging GitHub actionsGophishdomain format. Hunt.io showed it resolving to a Microsoft IP in the Netherlands with an exposed GoPhish admin panel on the default port used 3333. That single find led us to uncover 18 additional domains onGreyNoisestarving for context, so I'd rather have one enriched indicator than 50 raw IP addresses. Tools like GreyNoise and Cymru save us from chasing scanner noise, while Hunt.io is perfect for drilling down onMalware Bazaarpopping up across multiple blogs, that's my cue to start building hunts. Same with sandboxes like Malware Bazaar and ANY.RUN if hundreds of researchers are suddenly analyzing a particular family, or it shows up inSigmaThe Sigma rule approach, or your Splunk hunting rules at research.splunk.com, give us that foundation so hunters can focus on the "what if" scenarios rather than reinventing basic queries. Try and automate the hell outSplunk Attack RangeWe specifically are now using or looking to use their CapAttack (attack capturing) tool inside the Splunk Attack Range to have better data captures during our attack simulation. I'm hoping that the community can