deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Raven Tait, Splunk
Date: 2026-04-13

Description:
This analytic detects command-line arguments associated with the cloudflared client used to create Cloudflare tunnels.
Cloudflared is functionally very similar to ngrok, an ingress-as-a-service tool.
Cloudflared reaches out to the Cloudflare Edge Servers, creating an outbound connection over HTTPS(HTTP2/QUIC), where the tunnel's controller makes services or private networks accessible.

References:
  - https://www.guidepointsecurity.com/blog/tunnel-vision-cloudflared-abused-in-the-wild/
  - https://github.com/cloudflare/cloudflared
  - https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/security/hackers-increasingly-abuse-cloudflare-tunnels-for-stealthy-connections/amp/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk, sidoyle from Splunk Community
Date: 2026-04-15

Description:
This detection identifies when the xp_cmdshell configuration is modified in SQL Server. The xp_cmdshell extended stored procedure allows execution of operating system commands and programs from SQL Server, making it a high-risk feature commonly abused by attackers for privilege escalation and lateral movement.

References:
  - https://learn.microsoft.com/en-us/sql/relational-databases/system-stored-procedures/xp-cmdshell-transact-sql
  - https://attack.mitre.org/techniques/T1505/003/
  - https://learn.microsoft.com/en-us/sql/database-engine/configure-windows/xp-cmdshell-server-configuration-option
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2026-04-15

Description:
The following analytic detects suspicious data transfer activities that involve the use of the `split` syscall, potentially indicating an attempt to evade detection by breaking large files into smaller parts. Attackers may use this technique to bypass size-based security controls, facilitating the covert exfiltration of sensitive data. By monitoring for unusual or unauthorized use of the `split` syscall, this analytic helps identify potential data exfiltration attempts, allowing security teams to intervene and prevent the unauthorized transfer of critical information from the network.

References:
  - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2026-04-15

Description:
The following analytic detects the insertion of a Linux kernel module using the insmod utility. It leverages data from Linux Auditd, focusing on process execution logs that include process names and command-line details. This activity is significant as it may indicate the installation of a rootkit or malicious kernel module, potentially allowing an attacker to gain elevated privileges and bypass security detections. If confirmed malicious, this could lead to unauthorized code execution, persistent access, and severe compromise of the affected system.

References:
  - https://docs.fedoraproject.org/en-US/fedora/rawhide/system-administrators-guide/kernel-module-driver-configuration/Working_with_Kernel_Modules/
  - https://security.stackexchange.com/questions/175953/how-to-load-a-malicious-lkm-at-startup
  - https://0x00sec.org/t/kernel-rootkits-getting-your-hands-dirty/1485
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Mauricio Velazco, Splunk
Date: 2026-02-25

Description:
The following analytic detects the execution of `powershell.exe` with the `Get-DomainController` command, which is used to discover remote systems within a Windows domain. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. Monitoring this activity is crucial as it may indicate an attempt to enumerate domain controllers, a common tactic in Active Directory discovery. If confirmed malicious, this activity could allow attackers to gain situational awareness, potentially leading to further exploitation and lateral movement within the network.

References:
  - https://attack.mitre.org/techniques/T1018/
  - https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainController/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2026-05-04

Description:
The following analytic detects modifications to the Windows registry that disable Windows Defender Signature Retirement. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to the DisableSignatureRetirement registry setting. This activity is significant because disabling signature retirement can prevent Windows Defender from removing outdated antivirus signatures, potentially reducing its effectiveness in detecting threats. If confirmed malicious, this action could allow an attacker to evade detection by using older, less relevant signatures, thereby compromising the system's security posture.

References:
  - https://x.com/malmoeb/status/[PII_REDACTED]89415386?s=20
  - https://github.com/undergroundwires/privacy.sexy
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2026-04-15

Description:
The following analytic detects the use of the PowerShell Cmdlet `export-certificate` by leveraging Script Block Logging. This activity is significant as it may indicate an adversary attempting to exfiltrate certificates from the local Certificate Store on a Windows endpoint. Monitoring this behavior is crucial because stolen certificates can be used to impersonate users, decrypt sensitive data, or facilitate further attacks. If confirmed malicious, this activity could lead to unauthorized access to encrypted communications and sensitive information, posing a severe security risk.

References:
  - https://dev.to/iamthecarisma/managing-windows-pfx-certificates-through-powershell-3pj
  - https://learn.microsoft.com/en-us/powershell/module/pki/export-certificate?view=windowsserver2022-ps
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2026-04-15

Description:
The following analytic detects the use of Windows InstallUtil.exe with an HTTP or HTTPS URL in the command line. This is identified through Endpoint Detection and Response (EDR) telemetry, focusing on command-line executions containing URLs. This activity is significant as it may indicate an attempt to download and execute malicious code, potentially bypassing application control mechanisms. If confirmed malicious, this could lead to unauthorized code execution, privilege escalation, or persistent access within the environment. Analysts should review the parent process, network connections, file modifications, and related processes for further investigation.

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md
  - https://gist.github.com/DanielRTeixeira/0fd06ec8f041f34a32bf5623c6dd479d
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2026-04-15

Description:
The following analytic identifies the use of the 'kmod' process to list kernel modules on a Linux system. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. While listing kernel modules is not inherently malicious, it can be a precursor to loading unauthorized modules using 'insmod'. If confirmed malicious, this activity could allow an attacker to load kernel modules, potentially leading to privilege escalation, persistence, or other malicious actions within the system.

References:
  - https://man7.org/linux/man-pages/man8/kmod.8.html
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Nasreddine Bencherchali, Splunk
Date: 2026-04-15

Description:
The following analytic detects the creation of files associated with the NirSoft
tool bundles on Windows endpoints.
NirSoft is a well-known provider of free, portable utilities that can be used for various system and network tasks. However, threat actors often leverage these tools for malicious purposes, such as credential harvesting, network reconnaissance, and data exfiltration.
The detection focuses on the creation of specific NirSoft tool bundle files, which may indicate that an attacker is preparing to use these utilities on a compromised system.
Security teams should investigate any instances of these files being created, especially if they are found in unexpected locations or on systems that should not be using such tools.


References:
  - https://thedfirreport.com/2020/04/04/gogoogle-ransomware/
  - https://asec.ahnlab.com/en/48940/
  - https://www.trendmicro.com/en_gb/research/23/c/emotet-returns-now-adopts-binary-padding-for-evasion.html
  - https://www.welivesecurity.com/2022/06/16/how-emotet-is-changing-tactics-microsoft-tightening-office-macro-security/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2026-04-15

Description:
The following analytic detects modifications in the Windows registry to enable Remote Desktop Protocol (RDP) on a targeted machine. It leverages data from the Endpoint.Registry datamodel, specifically monitoring changes to the "fDenyTSConnections" registry value. This activity is significant as enabling RDP via registry is uncommon and often associated with adversaries or malware attempting to gain remote access. If confirmed malicious, this could allow attackers to remotely control the compromised host, potentially leading to further exploitation and lateral movement within the network.

References:
  - https://www.hybrid-analysis.com/sample/9d6611c2779316f1ef4b4a6edcfdfb5e770fe32b31ec2200df268c3bd236ed75?environmentId=100
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2026-04-15

Description:
The following analytic detects the creation or connection of anonymous pipes for inter-process communication (IPC) within a Windows environment. Anonymous pipes are commonly used by legitimate system processes, services, and applications to transfer data between related processes. However, adversaries frequently abuse anonymous pipes to facilitate stealthy process injection, command-and-control (C2) communication, credential theft, or privilege escalation. This detection monitors for unusual anonymous pipe activity, particularly involving non-system processes, unsigned executables, or unexpected parent-child process relationships. While legitimate use cases exist—such as Windows services, software installers, or security tools—unusual or high-frequency anonymous pipe activity should be investigated for potential malware, persistence mechanisms, or lateral movement techniques.

References:
  - https://www.trendmicro.com/en_nl/research/24/k/earth-estries.html
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2026-05-04

Description:
The following analytic identifies the use of taskkill.exe to forcibly terminate processes. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions that include specific taskkill parameters. This activity is significant because it can indicate attempts to disable security tools or disrupt legitimate applications, a common tactic in malware operations. If confirmed malicious, this behavior could allow attackers to evade detection, disrupt system stability, and potentially gain further control over the compromised system.

References:
  - https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2026-04-15

Description:
The following analytic detects the disabling of Windows Update services, such as "Update Orchestrator Service for Windows Update," "WaaSMedicSvc," and "Windows Update." It leverages Windows System Event ID 7040 logs to identify changes in service start modes to 'disabled.' This activity is significant as it can indicate an adversary's attempt to evade defenses by preventing critical updates, leaving the system vulnerable to exploits. If confirmed malicious, this could allow attackers to maintain persistence and exploit unpatched vulnerabilities, compromising the integrity and security of the affected host.

References:
  - https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Mauricio Velazco, Splunk
Date: 2026-04-15

Description:
The following analytic detects a process accessing the winlogon.exe system process, indicative of the Rubeus tool attempting to export Kerberos tickets from memory. This detection leverages Sysmon EventCode 10 logs, focusing on processes obtaining a handle to winlogon.exe with specific access rights. This activity is significant as it often precedes pass-the-ticket attacks, where adversaries use stolen Kerberos tickets to move laterally within an environment. If confirmed malicious, this could allow attackers to bypass normal access controls, escalate privileges, and persist within the network, posing a severe security risk.

References:
  - https://github.com/GhostPack/Rubeus
  - https://web.archive.org/web/[PII_REDACTED]5734/http://www.harmj0y.net/blog/redteaming/from-kekeo-to-rubeus/
  - https://attack.mitre.org/techniques/T1550/003/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2026-04-15

Description:
The following analytic detects the use of PowerShell's Invoke-RestMethod cmdlet to collect geolocation data from ipinfo.io or IP address information from api.ipify.org. This behavior leverages PowerShell Script Block Logging to identify scripts that gather external IP information and potential geolocation data. This activity is significant as it may indicate reconnaissance efforts, where threat actors are attempting to determine the geographical location or network details of a compromised system. While some legitimate software may use these services, this pattern is commonly observed in malware and post-exploitation toolkits like those used by Water Gamayun threat actors.

References:
  - https://securityintelligence.com/posts/new-threat-actor-water-gamayun-targets-telecom-finance/
  - https://www.ncsc.gov.uk/report/weekly-threat-report-12th-april-2024
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2026-04-16

Description:
The following analytic detects the launch of common .NET-related utilities—aspnet_compiler.exe, msbuild.exe, regasm.exe, InstallUtil.exe, or vbc.exe when the parent appears to be a script (batch, CMD, PowerShell, JScript, VBScript, or HTML) running from an unusual or user-writable Windows location (for example Public, Temp, Fonts, Debug, Recycle Bin, Prefetch, or similar paths), and the child process shows little or no command-line variation from the image path or name.
That pattern is consistent with adversaries using trusted .NET binaries as a proxy to run code while hiding execution behind script parents in low-trust folders, behavior associated with techniques such as signed binary proxy execution.

References:
  - https://www.joesandbox.com/analysis/1817558/0/pdfexecutive
  - https://www.broadcom.com/support/security-center/protection-bulletin/vip-keylogger-spreads-via-multi-org-impersonation-campaign
  - https://malpedia.caad.fkie.fraunhofer.de/details/win.vipkeylogger
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Bhavin Patel, Splunk
Date: 2026-03-26

Description:
The following analytic detects the use of `cmd.exe /c` to execute commands, a technique often employed by adversaries and malware to run batch commands or invoke other shells like PowerShell. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions and process metadata. Monitoring this activity is crucial as it can indicate script-based attacks or unauthorized command execution. If confirmed malicious, this behavior could lead to unauthorized code execution, privilege escalation, or persistence within the environment.

References:
  - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
  - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Dean Luxton
Date: 2026-04-15

Description:
The following analytic detects the loading of known vulnerable Windows drivers, which may indicate potential persistence or privilege escalation attempts. It leverages Windows System service install EventCode 7045 to identify driver loading events and cross-references them with a list of vulnerable drivers. This activity is significant as attackers often exploit vulnerable drivers to gain elevated privileges or maintain persistence on a system. If confirmed malicious, this could allow attackers to execute arbitrary code with high privileges, leading to further system compromise and potential data exfiltration. This detection is a Windows Event Log adaptation of the Sysmon driver loaded detection written by Michael Haag.

References:
  - https://loldrivers.io/
  - https://github.com/SpikySabra/Kernel-Cactus
  - https://github.com/wavestone-cdt/EDRSandblast
  - https://research.splunk.com/endpoint/a2b1f1ef-221f-4187-b2a4-d4b08ec745f4/
  - https://www.splunk.com/en_us/blog/security/these-are-the-drivers-you-are-looking-for-detect-and-prevent-malicious-drivers.html
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Dean Luxton
Date: 2026-04-15

Description:
The following analytic detects a user account initiating an Active Directory replication request, indicative of a DCSync attack. It leverages EventCode 4662 from the Windows Security Event Log, focusing on specific object types and replication permissions. This activity is significant because it can allow an attacker with sufficient privileges to request password hashes for any or all users within the domain. If confirmed malicious, this could lead to unauthorized access, privilege escalation, and potential compromise of the entire domain.

References:
  - https://adsecurity.org/?p=1729
  - https://www.linkedin.com/pulse/mimikatz-dcsync-event-log-detections-john-dwyer
  - https://github.com/SigmaHQ/sigma/blob/0.22-699-g29a5c6278/rules/windows/builtin/security/win_security_dcsync.yml
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2026-04-15

Description:
The following analytic detects the loading of specific dynamic-link libraries (DLLs) associated with the NetSupport Remote Manager (RMM) tool by any process on a Windows system.
Modules such as CryptPak.dll, HTCTL32.DLL, IPCTL32.DLL, keyshowhook.dll, pcicapi.DLL, PCICL32.DLL, and TCCTL32.DLL, are integral to NetSupport's functionality.
This detection is particularly valuable when these modules are loaded by processes running from unusual directories (e.g., Downloads, ProgramData, or user-specific folders) rather than the legitimate Program Files installation path, or by executables that have been renamed but retain the internal "client32" identifier.
This helps to identify instances where the legitimate NetSupport tool is being misused by adversaries as a Remote Access Trojan (RAT).


References:
  - https://www.linkedin.com/posts/mauricefielenbach_cybersecurity-incidentresponse-dfir-activity[PII_REDACTED]448418304-g0gZ?utm_source=share&utm_medium=member_desktop&rcm=ACoAAAuFTjIB5weY_kcyu4qp3kHbI4v49tO0zEk
  - https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/
  - https://www.esentire.com/blog/evalusion-campaign-delivers-amatera-stealer-and-netsupport-rat
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Raven Tait, Splunk
Date: 2026-04-13

Description:
This analytic detects the usage of the Azure CLI to interact with user accounts such as creating or deleting a user.
Adversaries create new users so that their malicious activity does not interrupt the normal functions of the compromised users and can remain undetected.
While legitimate administrative use is expected, anomalous execution patterns, unexpected users, or unusual parent processes should be treated as potential indicators of compromise and investigated promptly.

References:
  - https://atomicredteam.io/persistence/T1136.003/#atomic-test-3---azure-ad---create-a-new-user-via-azure-cli
  - https://learn.microsoft.com/en-us/cli/azure/?view=azure-cli-latest
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Mauricio Velazco, Splunk
Date: 2026-04-15

Description:
The following analytic identifies a single source endpoint failing to authenticate with 30 unique valid users using the NTLM protocol. It leverages EventCode 4776 from Domain Controller logs, focusing on error code 0xC000006A, which indicates a bad password. This behavior is significant as it may indicate a Password Spraying attack, where an adversary attempts to gain initial access or elevate privileges. If confirmed malicious, this activity could lead to unauthorized access to sensitive information or further compromise of the Active Directory environment.

References:
  - https://attack.mitre.org/techniques/T1110/003/
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-credential-validation
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4776
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Bhavin Patel, Splunk
Date: 2026-02-25

Description:
The following analytic detects executions of cmd.exe spawned by processes that are commonly abused by attackers and do not typically launch cmd.exe. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process GUID, process name, parent process, and command-line executions. This activity is significant because it may indicate an attempt to execute unauthorized commands or scripts, often a precursor to further malicious actions. If confirmed malicious, this behavior could lead to unauthorized code execution, privilege escalation, or persistence within the environment.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2026-04-15

Description:
The following analytic detects the execution of the 'rmdir' command with '/s' and '/q' options to delete files and directory trees. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions and process metadata. This activity is significant as it may indicate malware attempting to remove traces or components during cleanup operations. If confirmed malicious, this behavior could allow attackers to eliminate forensic evidence, hinder incident response efforts, and maintain persistence by removing indicators of compromise.

References:
  - https://malpedia.caad.fkie.fraunhofer.de/details/win.darkgate