Splunk Publishes Guide to Spot Remote Work Fraud in Organizations

Splunk today unveiled a comprehensive guide designed to empower security teams to detect Remote Employment Fraud (REF) during the onboarding phase, when imposters have already passed HR vetting and gained network access. According to Splunk, the guide builds on the inaugural blog and dives into the technical indicators that reveal fraudulent actors once they’re inside the infrastructure, using actionable SPL queries and integrations.

The guidance covers monitoring the post-hire environment, including correlating applicant tracking data with asset management logs to flag mismatches such as home_state versus delivered_location when shipping a corporate laptop. It also advises detecting nonstandard VPN usage by ingesting IdP logs from providers like Okta or Duo and scanning for connections from VPNs not sanctioned by policy, as well as improbable travel events flagged by session speed and distance metrics.

The publication further outlines recognising unusual audio/video device activity, measuring Zoom QoS metrics, and auditing endpoint tools with EDR logs from CrowdStrike or SentinelOne to block prohibited software.