We often hear about the results of research, but rarely about the process of research. Here Splunk researchers describe how they sought a solution to the malicious use of compromised credentials. Compromised credentials remain the primary initial entry point for the majority of system compromises. Cisco Talos says more than half of reported incidents start this way; Verizon’s DBIR says they account for 22% of all confirmed breaches; and M-Trends has the figure at 16%. Partly, if not entirely, this is due to increasing prevalence and sophistication of infostealers, and the ready availability of their logs on the dark web – suggesting the problem will get worse before it gets better. Credentials let the bad actors in, while guile and LOLBINs let them hide from detection. It is this problem…