Splunk-based threat hunting case study analyzing reconnaissance activity using the BOTS v2 dataset, focused on detecting anomalous user agents, pivoting to source IPs, and extracting actionable IOCs.

A hands-on Splunk threat hunting investigation focused on identifying initial access through spearphishing, user execution patterns, and IOC development.

This project simulates a proactive threat hunt based on a law enforcement advisory. Using the BOTSv2 (Boss of the SOC) dataset within Splunk, I identified an adversary conducting stealthy reconnaissance using a non-standard browser (Naenara) over port 80.