deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Michael Haag, Splunk
Date: 2025-10-06

Description:
The following analytic detects the execution of rundll32.exe loading setupapi.dll and iesetupapi.dll via the LaunchINFSection function. This behavior is identified using Endpoint Detection and Response (EDR) telemetry, focusing on process creation events and command-line arguments. This activity is significant as it indicates a potential application control bypass, allowing an attacker to execute arbitrary script code. If confirmed malicious, this technique could enable code execution, privilege escalation, or persistence within the environment, posing a severe threat to system integrity and security.

References:
  - https://attack.mitre.org/techniques/T1218/011/
  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.011/T1218.011.md
  - https://lolbas-project.github.io/lolbas/Binaries/Rundll32/
  - https://lolbas-project.github.io/lolbas/Libraries/Setupapi/
  - https://bohops.com/2018/02/26/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Rod Soto, Splunk
Date: 2024-11-14

Description:
This search provides information on Kubernetes RBAC authorizations by accounts, this search can be modified by adding rare or top to see both extremes of RBAC by accounts occurrences
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Patrick Bareiss, Mauricio Velazco, Splunk
Date: 2025-02-10

Description:
**DEPRECATION NOTE** - This search has been deprecated and replaced with `O365 Elevated Mailbox Permission Assigned`. This analytic identifies instances where potentially suspicious rights are delegated within the Office 365 environment. Specifically, it detects when a user is granted FullAccess, SendAs, or SendOnBehalf permissions on another users mailbox. Such permissions can allow a user to access, send emails from, or send emails on behalf of the target mailbox. The detection leverages O365 audit logs, focusing on the Add-MailboxPermission operation. By parsing the parameters of this operation, the analytic filters for events where FullAccess, SendAs, or SendOnBehalf rights are granted. It then aggregates this data to capture the source user (who was granted the permissions), the destination user (whose mailbox was affected), the specific operation, and the type of access rights granted. Delegating mailbox rights, especially those as powerful as FullAccess, can pose significant security risks. While there are legitimate scenarios for these permissions, such as an executive assistant needing access to an executives mailbox, there are also malicious scenarios where an attacker or a compromised insider might grant themselves unauthorized access to sensitive mailboxes. Monitoring for these permissions changes is crucial to detect potential insider threats, compromised accounts, or other malicious activities.If the detection is a true positive, it indicates that a user has been granted potentially high-risk permissions on another users mailbox. This could lead to unauthorized access to sensitive emails, impersonation through sending emails as or on behalf of the mailbox owner, or data manipulation by altering or deleting emails. Immediate investigation is required to validate the legitimacy of the permission change and to assess the potential risks associated with the granted access.

References:
  - https://www.mandiant.com/resources/blog/remediation-and-hardening-strategies-for-microsoft-365-to-defend-against-unc2452
  - https://attack.mitre.org/techniques/T1098/002/
  - https://attack.mitre.org/techniques/T1114/002/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Rod Soto, Splunk
Date: 2024-11-14

Description:
This search provides information of unauthenticated requests via user agent, and authentication data against Kubernetes cluster
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: David Dorsey, Splunk
Date: 2026-03-10

Description:
The following analytic detects an abnormally high number of cloud instances launched within a 4-hour period. It leverages cloud infrastructure logs and applies a probability density model to identify outliers based on historical data. This activity is significant for a SOC because a sudden spike in instance creation could indicate unauthorized access or misuse of cloud resources. If confirmed malicious, this behavior could lead to resource exhaustion, increased costs, or provide attackers with additional compute resources to further their objectives.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Rico Valdez, Dean Luxton, Bhavin Patel, Splunk
Date: 2025-05-02

Description:
This analytic has been deprecated in favour of a better named detection - Detect Large ICMP Traffic. The following analytic identifies outbound ICMP packets with a size larger than 1,000 bytes. It leverages the Network_Traffic data model to detect unusually large ICMP packets that are not blocked and are destined for external IP addresses. This activity is significant because threat actors often use ICMP for command and control communication, and large ICMP packets can indicate data exfiltration or other malicious activities. If confirmed malicious, this could allow attackers to maintain covert communication channels, exfiltrate sensitive data, or further compromise the network.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Dean Luxton
Date: 2025-06-16

Description:
This analytic looks for a the creation of potentially harmful GPO which could lead to persistence or code execution on remote hosts. Note, this analyic is looking for the absence of the corresponding 5136 events which is evidence of the GPOs being manually edited (using a tool like PowerView) or potentially missing logs.

References:
  - https://github.com/PowerShellMafia/PowerSploit/blob/26a0757612e5654b4f792b012ab8f10f95d391c9/Recon/PowerView.ps1#L5907-L6122
  - https://github.com/X-C3LL/GPOwned
  - https://rastamouse.me/ous-and-gpos-and-wmi-filters-oh-my/
  - https://wald0.com/?p=179
  - https://github.com/FSecureLABS/SharpGPOAbuse
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Rico Valdez, Splunk
Date: 2024-11-14

Description:
This search is used to detect attempts to use DNS tunneling, by calculating the length of responses to DNS TXT queries. Endpoints using DNS as a method of transmission for data exfiltration, Command And Control, or evasion of security controls can often be detected by noting unusually large volumes of DNS traffic. Deprecated because this detection should focus on DNS queries instead of DNS responses.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: David Dorsey, Splunk
Date: 2024-11-14

Description:
This search returns a list of hosts that have not successfully completed a backup in over a week. Deprecated because it's a infrastructure monitoring.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Gowthamaraj Rajendran, Patrick Bareiss, Bhavin Patel, Bryan Pluta, Splunk
Date: 2025-01-13

Description:
The following analytic has been deprecated in favour of specific and dedicated product analytics such as "Microsoft Defender ATP Alerts". The following analytic is to detect high and critical alerts from endpoint security tools such as Microsoft Defender, Carbon Black, and Crowdstrike. This query aggregates and summarizes critical severity alerts from the Alerts data model, providing details such as the alert signature, application, description, source, destination, and timestamps, while applying custom filters and formatting for enhanced analysis in a SIEM environment.This capability allows security teams to efficiently allocate resources and maintain a strong security posture, while also supporting compliance with regulatory requirements by providing a clear record of critical security events. We tested these detections with logs from Microsoft Defender, however this detection should work for any security alerts that are ingested into the alerts data model. **Note** - We are dynamically creating the risk_score field based on the severity of the alert in the SPL and that supersedes the risk score set in the detection.

References:
  - https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/accessing-microsoft-defender-for-cloud-alerts-in-splunk-using/ba-p/938228
  - https://docs.splunk.com/Documentation/CIM/5.3.2/User/Alerts
  - https://learn.microsoft.com/en-us/defender-endpoint/api/raw-data-export-event-hub
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Michael Haag, Splunk
Date: 2024-11-14

Description:
**DEPRECATION NOTE** - This search has been deprecated and replaced with `Okta Multiple Accounts Locked Out`. The following analytic utilizes the user.acount.lock event to identify associates who are locked out of Okta. An adversary attempting to brute force or password spray account names may lock accounts out depending on the threshold.

References:
  - https://developer.okta.com/docs/reference/api/event-types/?q=user.acount.lock
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Rod Soto, Splunk
Date: 2024-11-14

Description:
This search provides information of unauthenticated requests via source IP user agent, request URI and response status data against Kubernetes cluster in Azure
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Michael Haag, Splunk
Date: 2025-02-10

Description:
The following analytic has been deprecated in favour of a more generic approach in "Windows Office Product Spawned Uncommon Process". The following analytic detects any Windows Office Product spawning `wmic.exe`, specifically when the command-line of `wmic.exe` contains `wmic process call create`. This behavior is identified using data from Endpoint Detection and Response (EDR) agents, focusing on process and parent process relationships. This activity is significant as it is commonly associated with the Ursnif malware family, indicating potential malicious activity. If confirmed malicious, this could allow an attacker to execute arbitrary commands, leading to further system compromise, data exfiltration, or lateral movement within the network.

References:
  - https://app.any.run/tasks/fb894ab8-a966-4b72-920b-935f41756afd/
  - https://attack.mitre.org/techniques/T1047/
  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1047/T1047.md
  - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trojanized-onenote-document-leads-to-formbook-malware/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Michael Hart, Splunk
Date: 2026-03-10

Description:
The following analytic detects potentially malicious command lines using a pretrained machine learning text classifier. It identifies unusual keyword combinations in command lines, such as "streamreader," "webclient," "mutex," "function," and "computehash," which are often associated with adversarial PowerShell code execution for C2 communication. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on command lines longer than 200 characters. This activity is significant as it can indicate an attempt to execute malicious scripts, potentially leading to unauthorized code execution, data exfiltration, or further system compromise.

References:
  - https://attack.mitre.org/techniques/T1059/003/
  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Teoderick Contreras, Splunk
Date: 2025-01-24

Description:
The following analytic has been deprecated. The following analytic detects excessive usage of `net.exe` or `net1.exe` within a one-minute interval. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, parent processes, and command-line executions. This behavior is significant as it may indicate an adversary attempting to create, delete, or disable multiple user accounts rapidly, a tactic observed in Monero mining incidents. If confirmed malicious, this activity could lead to unauthorized user account manipulation, potentially compromising system integrity and enabling further malicious actions.

References:
  - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Michael Haag, Splunk
Date: 2025-02-10

Description:
The following hunting analytic is an experimental query built against a accidental feature using the latest Sysmon TA 3.0 (https://splunkbase.splunk.com/app/5709/) which maps the module load (ImageLoaded) to process_name. This analytic will deprecate once this is fixed. This hunting analytic identifies known libraries in Windows that may be used in a DLL search order hijack or DLL Sideloading setting. This may require recompiling the DLL, moving the DLL or moving the vulnerable process. The query looks for any running out of system32 or syswow64. Some libraries natively run out of other application paths and will need to be added to the exclusion as needed. The lookup is comprised of Microsoft native libraries identified within the Hijacklibs.net project.

References:
  - https://hijacklibs.net
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Mauricio Velazco, Splunk
Date: 2025-02-10

Description:
This search has been deprecated in favour of Windows Event Logging Service Has Shutdown . The following analytic detects the shutdown of the Windows Event Log service using Windows Event ID 1100. This event is logged every time the service stops, including during normal system shutdowns. Monitoring this activity is crucial as it can indicate attempts to cover tracks or disable logging. If confirmed malicious, an attacker could hide their activities, making it difficult to trace their actions and investigate further incidents. Analysts should verify if the shutdown was planned and review other alerts and data sources for additional suspicious behavior.

References:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-1100
  - https://www.ired.team/offensive-security/defense-evasion/disabling-windows-event-logs-by-suspending-eventlog-service-threads
  - https://attack.mitre.org/techniques/T1070/001/
  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.001/T1070.001.md
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Teoderick Contreras, Splunk
Date: 2025-02-10

Description:
The following analytic has been deprecated in favour of a more generic approach in "Windows Office Product Spawned Uncommon Process". The following analytic identifies instances where an Office application spawns a Regsvr32 process, which is often indicative of macro execution or malicious code. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events where the parent process is a known Office application. This activity is significant because it is a common technique used by malware, such as IcedID, to initiate infections. If confirmed malicious, this behavior could lead to code execution, allowing attackers to gain control over the affected system and potentially escalate privileges.

References:
  - https://www.joesandbox.com/analysis/380662/0/html
  - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trojanized-onenote-document-leads-to-formbook-malware/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: David Dorsey, Splunk
Date: 2024-11-14

Description:
This search looks for EC2 instances being modified by users who have not previously modified them. This search is deprecated and have been translated to use the latest Change Datamodel.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: David Dorsey, Splunk
Date: 2025-01-16

Description:
This search looks for EC2 instances being created by users who have not created them before. This search is deprecated and have been translated to use the latest Change Datamodel.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: David Dorsey, Splunk
Date: 2024-11-14

Description:
This search looks for AWS provisioning activities from previously unseen regions. Region in this context is similar to a state in the United States. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." This search is deprecated and have been translated to use the latest Change Datamodel.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Rico Valdez, Splunk
Date: 2024-11-14

Description:
This search looks for PowerShell requesting privileges consistent with credential dumping. Deprecated, looks like things changed from a logging perspective.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Michael Haag, Splunk, DipsyTipsy
Date: 2025-10-16

Description:
The following analytic detects the use of curl on Linux or MacOS systems to download a file from a remote source and pipe it directly to bash for execution. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, command-line arguments, and parent processes. This activity is significant as it is commonly associated with malicious actions such as coinminers and exploitation of vulnerabilities like CVE-2021-44228 in Log4j. If confirmed malicious, this behavior could lead to unauthorized code execution, system compromise, and further exploitation within the environment.

References:
  - https://www.huntress.com/blog/rapid-response-critical-rce-vulnerability-is-affecting-java
  - https://www.lunasec.io/docs/blog/log4j-zero-day/
  - https://gist.github.com/nathanqthai/01808c569903f41a52e7e7b575caa890
  - https://github.com/MHaggis/notes/blob/master/utilities/warp_pipe_tester.py
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Patrick Bareiss, Splunk
Date: 2025-02-10

Description:
The following analytic detects pull requests from unknown users on GitHub. It uses a Splunk query to identify pull requests where the user ID is not specified and cross-references these with a known users lookup table. This activity is significant because pull requests from unknown users can introduce malicious code or unauthorized changes to repositories. If confirmed malicious, this could lead to unauthorized code changes, data breaches, or other security incidents. Immediate steps include reviewing the author's name, repository, head reference, and commit message, and investigating any related artifacts and processes.

References:
  - https://www.splunk.com/en_us/blog/tips-and-tricks/getting-github-data-with-webhooks.html
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Bhavin Patel, Splunk
Date: 2024-11-14

Description:
This search will detect users creating spikes in API activity related to network access-control lists (ACLs)in your AWS environment. This search is deprecated and have been translated to use the latest Change Datamodel.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Mauricio Velazco, Splunk
Date: 2025-02-10

Description:
This search has been deprecated in favour of the more generic analytic "c5c8e0f3-147a-43da-bf04-4cfaec27dc44". The following analytic identifies the execution of `net.exe` with command-line arguments used to query domain groups, specifically `group /domain`. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. This activity is significant as it indicates potential reconnaissance efforts by adversaries to enumerate domain groups, which is a common step in Active Directory Discovery. If confirmed malicious, this behavior could allow attackers to gain insights into the domain structure, aiding in further attacks such as privilege escalation or lateral movement.

References:
  - https://attack.mitre.org/techniques/T1069/002/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Rod Soto, Splunk
Date: 2024-11-14

Description:
This search provides information on Kubernetes service accounts with failure or forbidden access status
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Bhavin Patel, Splunk
Date: 2024-11-14

Description:
This detection search will help profile user accounts in your environment by identifying newly created accounts that have been added to your network in the past week.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Rod Soto, Splunk
Date: 2024-11-14

Description:
The following analytic identifies the creation of new IAM roles by users in AWS. It leverages CloudWatch logs to detect events where the `CreateRole` action is performed, focusing on roles with specific trust policies. This activity is significant as unauthorized role creation can facilitate lateral movement and privilege escalation within the AWS environment. If confirmed malicious, attackers could gain elevated permissions, potentially compromising sensitive resources and data.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Rod Soto, Splunk
Date: 2024-11-14

Description:
This search provides detection of possible GCP Oauth token abuse. GCP Oauth token without time limit can be exfiltrated and reused for keeping access sessions alive without further control of authentication, allowing attackers to access and move laterally.

References:
  - https://www.netskope.com/blog/gcp-oauth-token-hijacking-in-google-cloud-part-1
  - https://www.netskope.com/blog/gcp-oauth-token-hijacking-in-google-cloud-part-2
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Bhavin Patel, Splunk
Date: 2024-11-14

Description:
The search is used to detect hosts that generate Windows Event ID 4663 for successful attempts to write to or read from a removable storage and Event ID 4656 for failures, which occurs when a USB drive is plugged in. In this scenario we are querying the Change_Analysis data model to look for Windows Event ID 4656 or 4663 where the priority of the affected host is marked as high in the ES Assets and Identity Framework.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Mauricio Velazco, Splunk
Date: 2025-01-24

Description:
The following analytic has been deprecated. The following analytic identifies the execution of `net.exe` or `net1.exe` with command-line arguments used to list network connections on a compromised system. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it indicates potential network reconnaissance by adversaries or Red Teams, aiming to gather situational awareness and Active Directory information. If confirmed malicious, this behavior could allow attackers to map the network, identify critical assets, and plan further attacks, potentially leading to data exfiltration or lateral movement.

References:
  - https://attack.mitre.org/techniques/T1049/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Dean Luxton
Date: 2025-01-24

Description:
The following analytic has been deprecated. This analytic detects network share discovery and collection activities performed on Windows systems using the Net command. Attackers often use network share discovery to identify accessible shared resources within a network, which can be a precursor to privilege escalation or data exfiltration. By monitoring Windows Event Logs for the usage of the Net command to list and interact with network shares, this detection helps identify potential reconnaissance and collection activities.

References:
  - https://attack.mitre.org/techniques/T1135/