deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Mauricio Velazco, Splunk
Date: 2026-04-15

Description:
The following analytic identifies when the results of a content search within the Office 365 Security and Compliance Center are exported. It uses the SearchExported operation from the SecurityComplianceCenter workload in the o365_management_activity data source. This activity is significant because exporting search results can involve sensitive or critical organizational data, potentially leading to data exfiltration. If confirmed malicious, an attacker could gain access to and exfiltrate sensitive information, posing a severe risk to the organization's data security and compliance posture.

References:
  - https://attack.mitre.org/techniques/T1114/002/
  - https://learn.microsoft.com/en-us/purview/ediscovery-content-search-overview
  - https://learn.microsoft.com/en-us/purview/ediscovery-keyword-queries-and-search-conditions
  - https://learn.microsoft.com/en-us/purview/ediscovery-search-for-activities-in-the-audit-log
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Patrick Bareiss, Splunk
Date: 2026-05-04

Description:
The following analytic detects when a user disables Dependabot security features within a GitHub repository. Dependabot helps automatically identify and fix security vulnerabilities in dependencies. The detection monitors GitHub Enterprise logs for configuration changes that disable Dependabot functionality. This behavior could indicate an attacker attempting to prevent the automatic detection of vulnerable dependencies, which would allow them to exploit known vulnerabilities that would otherwise be patched. For a SOC, identifying the disabling of security features like Dependabot is critical as it may be a precursor to supply chain attacks where attackers exploit vulnerable dependencies. The impact could be severe if vulnerabilities remain unpatched, potentially leading to code execution, data theft, or other compromises through the software supply chain.

References:
  - https://splunk.github.io/splunk-add-on-for-github-audit-log-monitoring/Install/
  - https://www.googlecloudcommunity.com/gc/Community-Blog/Monitoring-for-Suspicious-GitHub-Activity-with-Google-Security/ba-p/763610
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Mauricio Velazco, Splunk
Date: 2026-04-15

Description:
The following analytic identifies instances where a user has denied consent to an OAuth application seeking permissions within the Office 365 environment. This detection leverages O365 audit logs, focusing on events related to user consent actions. By filtering for denied consent actions associated with OAuth applications, it captures instances where users have actively rejected permission requests. This activity is significant as it may indicate users spotting potentially suspicious or unfamiliar applications. If confirmed malicious, it suggests an attempt by a potentially harmful application to gain unauthorized access, which was proactively blocked by the user.

References:
  - https://attack.mitre.org/techniques/T1528/
  - https://www.microsoft.com/en-us/security/blog/2022/09/22/malicious-oauth-applications-used-to-compromise-email-servers-and-spread-spam/
  - https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/protect-against-consent-phishing
  - https://learn.microsoft.com/en-us/defender-cloud-apps/investigate-risky-oauth
  - https://www.alteredsecurity.com/post/introduction-to-365-stealer
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Steven Dick
Date: 2026-04-15

Description:
The following analytic detects potential privilege escalation threats in Azure Active Directory (AD). This detection is important because it identifies instances where privileged roles that hold elevated permissions are assigned to service principals. This prevents unauthorized access or malicious activities, which occur when these non-human entities access Azure resources to exploit them. False positives might occur since administrators can legitimately assign privileged roles to service principals. This detection leverages the O365 Universal Audit Log data source.

References:
  - https://attack.mitre.org/techniques/T1098/003/
  - https://learn.microsoft.com/en-us/azure/active-directory/roles/permissions-reference
  - https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/about-exchange-online-admin-role?view=o365-worldwide
  - https://posts.specterops.io/azure-privilege-escalation-via-service-principal-abuse-210ae2be2a5
Sigma Detection Rule: 
Repository: splunk/security_content
Status: experimental
Author: Matthew Moore, Splunk
Date: 2026-03-10

Description:
The following analytic detects previously unseen processes within the Kubernetes environment on master or worker nodes. It leverages process metrics collected via an OTEL collector and hostmetrics receiver, and data is pulled from Splunk Observability Cloud. This detection compares processes observed in the last hour against those seen in the previous 30 days. Identifying new processes is crucial as they may indicate unauthorized activity or attempts to compromise the node. If confirmed malicious, these processes could lead to data exfiltration, privilege escalation, denial-of-service attacks, or the introduction of malware, posing significant risks to the Kubernetes cluster.

References:
  - https://github.com/signalfx/splunk-otel-collector-chart
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Bhavin Patel, Splunk
Date: 2026-04-15

Description:
The following analytic identifies potential AWS S3 exfiltration behavior by correlating multiple risk events related to Collection and Exfiltration techniques. It leverages risk events from AWS sources, focusing on instances where two or more unique analytics and distinct MITRE ATT&CK IDs are triggered for a specific risk object. This activity is significant as it may indicate an ongoing data exfiltration attempt, which is critical for security teams to monitor. If confirmed malicious, this could lead to unauthorized access and theft of sensitive information, compromising the organization's data integrity and confidentiality.

References:
  - https://labs.nettitude.com/blog/how-to-exfiltrate-aws-ec2-data/
  - https://stratus-red-team.cloud/attack-techniques/AWS/aws.exfiltration.ec2-share-ebs-snapshot/
  - https://hackingthe.cloud/aws/enumeration/loot_public_ebs_snapshots/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Steven Dick
Date: 2026-04-15

Description:
The following analytic identifies when cross-tenant access/synchronization policies are changed in an Azure tenant. Adversaries have been observed altering victim cross-tenant policies as a method of lateral movement or maintaining persistent access to compromised environments. These policies should be considered sensitive and monitored for changes and/or loose configuration.

References:
  - https://attack.mitre.org/techniques/T1484/002/
  - https://thehackernews.com/2023/08/emerging-attacker-exploit-microsoft.html
  - https://cyberaffairs.com/news/emerging-attacker-exploit-microsoft-cross-tenant-synchronization/
  - https://www.crowdstrike.com/blog/crowdstrike-defends-against-azure-cross-tenant-synchronization-attacks/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Steven Dick
Date: 2026-04-15

Description:
The following analytic identifies when an O365 email account sends and then hard deletes an email to an external recipient within a short period (within 1 hour). This behavior may indicate a compromised account where the threat actor is attempting to remove forensic artifacts or evidence of exfiltration activity. This behavior is often seen when threat actors want to reduce the probability of detection by the compromised account owner.

References:
  - https://attack.mitre.org/techniques/T1114/
  - https://www.hhs.gov/sites/default/files/help-desk-social-engineering-sector-alert-tlpclear.pdf
  - https://intelligence.abnormalsecurity.com/attack-library/threat-actor-convincingly-impersonates-employee-requesting-direct-deposit-update-in-likely-ai-generated-attack
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Mauricio Velazco, Splunk
Date: 2026-04-15

Description:
The following analytic detects when emails are accessed in Office 365 Exchange via Exchange Web Services (EWS) using OAuth-authenticated applications. It leverages the ClientInfoString field to identify EWS interactions and aggregates metrics such as access counts, timing, and client IP addresses, categorized by user, ClientAppId, OperationCount, and AppId. Monitoring OAuth applications accessing emails through EWS is crucial for identifying potential abuse or unauthorized data access. If confirmed malicious, this activity could lead to unauthorized email access, data exfiltration, or further compromise of sensitive information.

References:
  - https://attack.mitre.org/techniques/T1114/002/
  - https://www.microsoft.com/en-us/security/blog/2024/01/25/midnight-blizzard-guidance-for-responders-on-nation-state-attack/
  - https://learn.microsoft.com/en-us/exchange/client-developer/exchange-web-services/ews-applications-and-the-exchange-architecture
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2026-02-25

Description:
The following analytic detects the deletion of an IAM policy in AWS. It leverages AWS CloudTrail logs to identify `DeletePolicy` events, excluding those from AWS internal services. This activity is significant as unauthorized policy deletions can disrupt access controls and weaken security postures. If confirmed malicious, an attacker could remove critical security policies, potentially leading to privilege escalation, unauthorized access, or data exfiltration. Monitoring this behavior helps ensure that only authorized changes are made to IAM policies, maintaining the integrity and security of the AWS environment.

References:
  - https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeletePolicy.html
  - https://docs.aws.amazon.com/cli/latest/reference/iam/delete-policy.html
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Mauricio Velazco, Splunk
Date: 2026-04-15

Description:
The following analytic detects the activation of an Azure AD Privileged Identity Management (PIM) role. It leverages Azure Active Directory events to identify when a user activates a PIM role assignment, indicated by the "Add member to role completed (PIM activation)" operation. Monitoring this activity is crucial as PIM roles grant elevated privileges, and unauthorized activation could indicate an adversary attempting to gain privileged access. If confirmed malicious, this could lead to unauthorized administrative actions, data breaches, or further compromise of the Azure environment.

References:
  - https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-configure
  - https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-how-to-activate-role
  - https://microsoft.github.io/Azure-Threat-Research-Matrix/PrivilegeEscalation/AZT401/AZT401/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Patrick Bareiss, Splunk
Date: 2026-05-04

Description:
The following analytic identifies when an IP allow list is disabled in GitHub Enterprise. The detection monitors GitHub Enterprise audit logs for actions related to disabling IP allow lists at the organization or enterprise level. This behavior is concerning because IP allow lists are a critical security control that restricts access to GitHub Enterprise resources to only trusted IP addresses. When disabled, it could indicate an attacker attempting to bypass access controls to gain unauthorized access from untrusted networks. The impact includes potential exposure of sensitive code repositories and GitHub Enterprise resources to access from any IP address. SOC teams should investigate such events, especially if they were not pre-approved changes, as they may indicate compromise of admin credentials or malicious insider activity.

References:
  - https://www.googlecloudcommunity.com/gc/Community-Blog/Monitoring-for-Suspicious-GitHub-Activity-with-Google-Security/ba-p/763610
  - https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-streaming-to-splunk
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Patrick Bareiss, Splunk
Date: 2026-04-15

Description:
The following analytic detects the creation of a Kubernetes NodePort service, which exposes a service to the external network. It identifies this activity by monitoring Kubernetes Audit logs for the creation of NodePort services. This behavior is significant for a SOC as it could allow an attacker to access internal services, posing a threat to the Kubernetes infrastructure's integrity and security. If confirmed malicious, this activity could lead to data breaches, service disruptions, or unauthorized access to sensitive information.

References:
  - https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Bhavin Patel, Mauricio Velazco, Splunk
Date: 2026-04-15

Description:
The following analytic detects failed authentication attempts during the Multi-Factor Authentication (MFA) challenge on a Google Cloud Platform (GCP) tenant. It uses Google Workspace login failure events to identify instances where MFA methods were challenged but not successfully completed. This activity is significant as it may indicate an adversary attempting to access an account with compromised credentials despite MFA protection. If confirmed malicious, this could lead to unauthorized access attempts, potentially compromising sensitive data and resources within the GCP environment.

References:
  - https://attack.mitre.org/techniques/T1621/
  - https://attack.mitre.org/techniques/T1078/004/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Patrick Bareiss, Splunk
Date: 2026-04-15

Description:
The following analytic detects the creation of a Kubernetes cron job, which is a task scheduled to run automatically at specified intervals. It identifies this activity by monitoring Kubernetes Audit logs for the creation events of cron jobs. This behavior is significant for a SOC as it could allow an attacker to execute malicious tasks repeatedly and automatically, posing a threat to the Kubernetes infrastructure. If confirmed malicious, this activity could lead to persistent attacks, service disruptions, or unauthorized access to sensitive information.

References:
  - https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Jake Enea
Date: 2026-03-27

Description:
The following analytic detects a high volume of "wipe ManagedDevice" events from the Intune admin portal (5+ per hour by default).
It leverages Intune audit logs to identify when this action is triggered. This activity is significant beacuse the "wipe ManagedDevice" action factory resets devices connected to your Microsoft Intune tenant.
If confirmed malicious, an attacker can abuse this action to perform a large-scale data wiping attack against your managed endpoints.

References:
  - https://www.lumos.com/blog/stryker-hack
  - https://www.covertswarm.com/post/swarm-intelligence-strykers-intune-wipe-proves-your-bcdr-plan-has-a-single-point-of-failure
  - https://www.wwt.com/blog/how-the-stryker-intune-wipe-incident-highlights-a-critical-gap-in-endpoint-control
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Mauricio Velazco, Splunk
Date: 2026-04-15

Description:
The following analytic identifies the creation of new email forwarding rules in an Office 365 environment. It detects events logged under New-InboxRule and Set-InboxRule operations within the o365_management_activity data source, focusing on parameters like ForwardTo, ForwardAsAttachmentTo, and RedirectTo. This activity is significant as unauthorized email forwarding can lead to data exfiltration and unauthorized access to sensitive information. If confirmed malicious, attackers could intercept and redirect emails, potentially compromising confidential communications and leading to data breaches.

References:
  - https://attack.mitre.org/techniques/T1114/003/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2026-04-15

Description:
The following analytic identifies excessive AccessDenied events within an hour timeframe for IAM users in AWS. It leverages AWS CloudTrail logs to detect multiple failed access attempts from the same source IP and user identity. This activity is significant as it may indicate that an access key has been compromised and is being misused for unauthorized discovery actions. If confirmed malicious, this could allow attackers to gather information about the AWS environment, potentially leading to further exploitation or privilege escalation.

References:
  - https://aws.amazon.com/premiumsupport/knowledge-center/troubleshoot-iam-permission-errors/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
Date: 2026-04-15

Description:
The following analytic detects the addition of a new federated domain within an Azure Active Directory tenant. It leverages Azure AD AuditLogs to identify successful "Set domain authentication" operations. This activity is significant as it may indicate the use of the Azure AD identity federation backdoor technique, allowing an adversary to establish persistence. If confirmed malicious, the attacker could impersonate any user, bypassing password and MFA requirements, potentially leading to unauthorized access and control over the Azure AD environment.

References:
  - https://www.mandiant.com/resources/remediation-and-hardening-strategies-microsoft-365-defend-against-apt29-v13
  - https://o365blog.com/post/federation-vulnerability/
  - https://www.inversecos.com/2021/11/how-to-detect-azure-active-directory.html
  - https://www.mandiant.com/resources/blog/detecting-microsoft-365-azure-active-directory-backdoors
  - https://attack.mitre.org/techniques/T1484/002/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Mauricio Velazco, Splunk
Date: 2026-04-15

Description:
The following analytic detects the assignment of privileged roles to service principals in Azure Active Directory (AD). It leverages the AuditLogs log category from ingested Azure AD events. This activity is significant because assigning elevated permissions to non-human entities can lead to unauthorized access or malicious activities. If confirmed malicious, attackers could exploit these service principals to gain elevated access to Azure resources, potentially compromising sensitive data and critical infrastructure. Monitoring this behavior helps prevent privilege escalation and ensures the security of Azure environments.

References:
  - https://posts.specterops.io/azure-privilege-escalation-via-service-principal-abuse-210ae2be2a5
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Patrick Bareiss, Splunk
Date: 2026-05-04

Description:
The following analytic detects the deletion of CloudWatch log groups in AWS, identified through `DeleteLogGroup` events in CloudTrail logs. This method leverages Amazon Security Lake logs parsed in the OCSF format. The activity is significant because attackers may delete log groups to evade detection and disrupt logging capabilities, hindering incident response efforts. If confirmed malicious, this action could allow attackers to cover their tracks, making it difficult to trace their activities and potentially leading to undetected data breaches or further malicious actions within the compromised AWS environment.

References:
  - https://attack.mitre.org/techniques/T1562/008/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Patrick Bareiss, Splunk
Date: 2026-05-04

Description:
The following analytic detects `UpdateTrail` events within AWS CloudTrail logs, aiming to identify attempts by attackers to evade detection by altering logging configurations. By updating CloudTrail settings with incorrect parameters, such as changing multi-regional logging to a single region, attackers can impair the logging of their activities across other regions. This behavior is crucial for Security Operations Centers (SOCs) to identify, as it indicates an adversary's intent to operate undetected within a compromised AWS environment. The impact of such evasion tactics is significant, potentially allowing malicious activities to proceed without being logged, thereby hindering incident response and forensic investigations.

References:
  - https://attack.mitre.org/techniques/T1562/008/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: experimental
Author: Marissa Bower, Raven Tait
Date: 2026-04-15

Description:
Geolocation data can be inaccurate or easily spoofed by Remote Employment Fraud (REF) workers. REF actors sometimes slip up and reveal their true location, creating what we call 'improbable travel' scenarios — logins from opposite sides of the world within minutes. This identifies situations where these travel scenarios occur.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Bhavin Patel, Splunk
Date: 2026-04-15

Description:
The following analytic detects an AWS account successfully authenticating from multiple unique IP addresses within a 5-minute window. It leverages AWS CloudTrail logs, specifically monitoring `ConsoleLogin` events and counting distinct source IPs. This behavior is significant as it may indicate compromised credentials, potentially from a phishing attack, being used concurrently by an adversary and a legitimate user. If confirmed malicious, this activity could allow unauthorized access to corporate resources, leading to data breaches or further exploitation within the AWS environment.

References:
  - https://rhinosecuritylabs.com/aws/mfa-phishing-on-aws/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2026-04-15

Description:
The following analytic identifies Gsuite emails with suspicious subjects and attachments commonly used in spear phishing attacks. It leverages Gsuite email logs, focusing on specific keywords in the subject line and known malicious file types in attachments. This activity is significant for a SOC as spear phishing is a prevalent method for initial compromise, often leading to further malicious actions. If confirmed malicious, this activity could result in unauthorized access, data exfiltration, or further malware deployment, posing a significant risk to the organization's security.

References:
  - https://www.redhat.com/en/topics/devops/what-is-devsecops
  - https://www.mandiant.com/resources/top-words-used-in-spear-phishing-attacks