deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Michael Haag, Splunk
Date: 2025-08-05

Description:
This data source captures Windows Event Logs from the Microsoft-Windows-AppXDeploymentServer/Operational channel, specifically focusing on EventCode 400. These events are generated when a package deployment operation begins, providing details about the package being deployed.

Event ID 400 is particularly significant for security monitoring as it includes information about whether the package has full trust privileges. Full trust packages run with elevated privileges outside the normal AppX container restrictions, allowing them to access system resources that regular AppX packages cannot.

Adversaries have been observed leveraging full trust MSIX packages to deliver malware, as documented in recent threat intelligence reports. Monitoring these events can help identify potentially malicious package installations that request elevated privileges.


References:
  - https://learn.microsoft.com/en-us/windows/msix/desktop/desktop-to-uwp-behind-the-scenes
  - https://learn.microsoft.com/en-us/windows/msix/package/package-identity
  - https://redcanary.com/blog/threat-intelligence/msix-installers/
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs an event when an Azure Automation account is created or updated.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs the creation of new entries in a network ACL, including rules to allow or deny specific network traffic.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Bhavin Patel, Splunk
Date: 2023-10-15

Description:
Logs an event when a knowledge base is deleted within the AWS CloudTrail.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Bhavin Patel, Splunk
Date: 2025-07-10

Description:
Data source object for Windows Event Log Security 4754
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-07-10

Description:
Logs an event when an account fails to log on to a system.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs an event when the bucket versioning state is modified in an AWS S3 bucket.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs the deletion of an IP set in AWS WAF or GuardDuty, including details about the IP set ID and its associated configurations.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-07-10

Description:
Logs an event when a new scheduled task is created
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Bhavin Patel, Splunk
Date: 2025-01-23

Description:
Logs security incidents and correlated alerts in Microsoft 365 Defender, including details about affected assets, threat types, and remediation steps.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Bhavin Patel, Splunk
Date: 2025-07-10

Description:
Data source object for Sysmon EventID 26
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Bhavin Patel, Splunk
Date: 2025-01-23

Description:
Logs the deletion of CloudWatch alarms, including details about the alarm names and associated monitoring configurations.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs an event when printer drivers are installed or updated on the system.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs authentication and multi-factor authentication (MFA) events managed by PingID, including user logins, device enrollments, and MFA challenges.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs the deletion of an IAM group in AWS, including details about the group name and its associated policies or members.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-07-10

Description:
Logs an event when an account successfully logs on to a system.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Michael Haag, Splunk
Date: 2025-08-05

Description:
This data source captures Windows Event Logs from the Microsoft-Windows-AppXDeploymentServer/Operational channel, specifically focusing on EventCode 855. These events are generated when a package deployment operation completes successfully, providing details about the packages that were installed or updated.

Event ID 855 is particularly valuable for security monitoring as it confirms the successful installation of MSIX packages, including information about the package identifiers. This can help identify potentially malicious package installations in an environment.

Monitoring these events can help track MSIX package installations across an environment, which is important given that MSIX packages have been leveraged by threat actors such as FIN7, Zloader (Storm-0569), and FakeBat (Storm-1113) for malware delivery.


References:
  - https://learn.microsoft.com/en-us/windows/win32/appxpkg/troubleshooting
  - https://www.advancedinstaller.com/msix-installation-or-launching-errors-and-fixes.html
  - https://redcanary.com/blog/msix-installers/
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-07-10

Description:
Logs changes to a registry key, including details about the modified key, value, and associated process.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-07-10

Description:
Logs DNS query events, including details about the queried domain, source IP, query type, and response data.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs an event when the attributes of an Amazon Machine Image (AMI) are modified.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-07-10

Description:
Logs an event when a user with administrative privileges logs on to a system.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Nasreddine Bencherchali, Splunk
Date: 2025-05-22

Description:
Data source object for raw connection events from Cisco Secure Firewall Threat Defense
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs the deletion of a network ACL entry in AWS, including details about the rule number and associated network ACL.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs the deletion of a CloudWatch log group, including details about the log group name and associated resources.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2026-03-31

Description:
Logs network traffic events captured by Palo Alto Networks devices, including details about sessions, protocols, and source and destination IPs.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Kelby Shelton, Splunk
Date: 2021-12-14

Description:
Published in response to CVE-2021-44228, this playbook uses WinRM to scan Windows endpoints for the presence of "jndilookup.class" in all .jar files. The presence of that string could indicate a log4j vulnerability.

References:
  - https://twitter.com/CyberRaiju/status/[PII_REDACTED]80124160
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Kelby Shelton, Splunk
Date: 2021-10-22

Description:
This playbook collects the available Indicator data types within the event as well as available investigative playbooks. It will launch any playbooks that meet the filtered criteria.

References:
  - https://help.splunk.com/en/splunk-enterprise-security-8/security-content-update/how-to-use-splunk-security-content/5.8/use-splunk-soar-playbooks-and-workbooks-from-the-risk-notable-playbook-pack/build-playbooks-compatible-with-the-dispatch_input_playbooks-utility
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Lou Stella, Splunk
Date: 2021-12-14

Description:
Published in response to CVE-2021-44228, this playbook utilizes data already in your Splunk environment to help investigate and remediate impacts caused by this vulnerability in your environment.

References:
  - https://www.splunk.com/en_us/blog/security/log-jammin-log4j-2-rce.html
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Philip Royer, Splunk
Date: 2021-02-25

Description:
This playbook is used to enrich and respond to a CrowdStrike Falcon detection involving a potentially malicious executable on an endpoint. Check for previous sightings of the same executable, hunt across other endpoints for the file, gather details about all processes associated with the file, and collect all the gathered information into a prompt for an analyst to review. Based on the analyst's choice, the file can be added to the custom indicators list in CrowdStrike with a detection policy of "detect" or "none", and the endpoint can be optionally quarantined from the network.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Christian Cloutier, Splunk
Date: 2025-06-09

Description:
Accepts a hostname or device id as well as a file path as input and restores the file from the File Vault to a device in Crowdstrike. We then generate an observable report as well as a Markdown formatted report. Both reports can be customized based on user preference.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Lou Stella, Splunk
Date: 2023-05-23

Description:
Automatically dispatches input playbooks with the 'enable_account' tag. This will produce a merge report and indicator tag for each inputs.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Kelby Shelton, Splunk
Date: 2021-10-07

Description:
Handle cases in Splunk SOAR with consistency that only automation can provide. This playbook ensures that cases are being assigned to analysts, and follow on work gets started.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Kelby Shelton, Splunk
Date: 2021-12-14

Description:
Published in response to CVE-2021-44228, this playbook accepts a list of hosts and filenames to remediate on the endpoint. If filenames are provided, the endpoints will be searched and then the user can approve deletion. Then the user is prompted to quarantine the endpoint.

References:
  - https://github.com/Neo23x0/Fenrir/blob/master/fenrir.sh
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Christian Cloutier, Splunk
Date: 2025-06-09

Description:
Accepts a hostname or device id as well as one or more process IDs as input and terminates those process(es) on a device in CrowdStrike. We then generate an observable report as well as a Markdown formatted report. Both reports can be customized based on user preference.  Note that the Markdown report can report a status of success even when a particular PID is not actually killed.  Rely on the observable output if you need to reliably check that.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2023-07-14

Description:
Accepts a list of domains and blocks them. Generates a global report and list of observables.

References:
  - https://d3fend.mitre.org/technique/d3f:DNSDenylisting/
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Lou Stella, Splunk
Date: 2024-01-21

Description:
Accepts a gmail email ID, and then attempts to delete the email from the mailbox. GMail does not have a "soft-delete" option, messages run through the Message Eviction playbook will be permanently deleted.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Christian Cloutier, Splunk
Date: 2025-06-09

Description:
Accepts a hostname or device id as well as a file path as input and collects the file to the event File Vault from a device in Crowdstrike. An artifact is created from the collected file.  We then generate an observable report as well as a Markdown formatted report. Both reports can be customized based on user preference.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Teoderick Contreras, Splunk
Date: 2023-05-08

Description:
Accepts user, to be disabled using Azure AD Graph connector. This playbook produces a normalized observables output for each user and device.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Philip Royer, Splunk
Date: 2021-01-19

Description:
This playbook tries to determine if a file is malware and whether or not the file is present on any managed machines. VirusTotal "file reputation" and PAN WildFire "detonate file" are used to determine if a file is malware, and CarbonBlack Response "hunt file" is used to search managed machines for the file. The results of these investigations are summarized in an email to the incident response team.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Teoderick Contreras, Splunk
Date: 2023-05-23

Description:
Automatically dispatches input playbooks with the 'disable_account' tag. This will produce a merge report and indicator tag for each inputs.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Christian Cloutier, Splunk
Date: 2025-06-09

Description:
Accepts a hostname or device id as input and attempts to isolate (quarantine) the device in Crowdstrike. We then generate an observable report as well as a Markdown formatted report from the results. Both reports can be customized based on user preference.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Kelby Shelton, Splunk
Date: 2021-10-22

Description:
This playbook gathers all of the events associated with the risk notable and imports them as artifacts. It also generates a custom markdown formatted note.

References:
  - https://help.splunk.com/en/splunk-enterprise-security-8/security-content-update/how-to-use-splunk-security-content/5.8/use-splunk-soar-playbooks-and-workbooks-from-the-risk-notable-playbook-pack/get-started-with-the-risk-notable-playbook-pack-for-splunk-soar
  - http://docs.splunk.com/Documentation/ES/6.6.2/Admin/Configurecorrelationsearches#Use_security_framework_annotations_in_correlation_searches
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Teoderick Contreras, Splunk
Date: 2023-01-11

Description:
Accepts a user or device and looks up the most recent attributes and groups for that user or device. This playbook produces a normalized output for each user and device.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Christian Cloutier, Splunk
Date: 2025-06-09

Description:
Accepts a hostname or device id as input and tries to restore access for (unquarantines) the device in Crowdstrike. We then generate an observable report as well as a Markdown formatted report of the results.  Both can be customized based on user preference.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Kelby Shelton, Lou Stella, Splunk
Date: 2023-01-11

Description:
Accepts a URL, IP, Domain, or File_Hash and does reputation analysis on the objects. Generates a global report and a per observable sub-report and normalized score. The score can be customized based on a variety of factors.

References:
  - https://d3fend.mitre.org/technique/d3f:IdentifierReputationAnalysis/
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Kelby Shelton, Splunk
Date: 2021-12-14

Description:
Performs a general investigation on key aspects of a windows device using windows remote management. Important files related to the endpoint are generated, bundled into a zip, and copied to the container vault.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Philip Royer, Splunk
Date: 2021-01-21

Description:
This playbook retrieves IP addresses, domains, and file hashes, blocks them on various services, and adds them to specific blocklists as custom lists.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Lou Stella, Splunk
Date: 2024-02-03

Description:
Accepts an internet message id, and asks Microsoft for a list of users with mailboxes to search, and then searches each one to look for records that have a matching internet message id.  It then produces a normalized output and summary table.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Teoderick Contreras, Splunk
Date: 2023-03-23

Description:
Accepts a url link, domain or vault_id (hash) to be detonated using Virustotal V3 connector.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Kelby Shelton, Splunk
Date: 2021-10-22

Description:
This playbook checks for the presence of the Risk Response workbook and updates tasks or leaves generic notes. The risk_notable_verdict playbooks recommends this playbook as a second phase of the investigation. Additionally, this playbook can be used in ad-hoc investigations or incorporated into custom workbooks.

References:
  - https://help.splunk.com/en/splunk-enterprise-security-8/security-content-update/how-to-use-splunk-security-content/5.8/use-splunk-soar-playbooks-and-workbooks-from-the-risk-notable-playbook-pack/get-started-with-the-risk-notable-playbook-pack-for-splunk-soar
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Teoderick Contreras, Splunk
Date: 2023-03-23

Description:
Accepts a url link, IP, or domain to be detonated using urlscan.io API connector.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Lou Stella, Splunk
Date: 2024-01-21

Description:
Accepts message ID that needs to be evicted from provided email mailbox in Microsoft Office365. Generates an observable output based on the status of message eviction.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Kelby Shelton, Splunk
Date: 2023-01-11

Description:
Accepts a user or device and looks up the most recent attributes and groups for that user or device. This playbook produces a normalized output for each user and device.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Teoderick Contreras, Splunk
Date: 2023-05-08

Description:
Accepts user name that needs to be disabled in AWS IAM Active Directory. Disabling an account involves deleting their login profile which will clear the user's password. Generates an observable output based on the status of account locking or disabling.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Lou Stella, Splunk; Kelby Shelton, Splunk
Date: 2023-01-26

Description:
Accepts an internet message id, and asks Splunk to look for records that have a matching internet message id.  It then produces a normalized output and summary table.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Teoderick Contreras, Splunk
Date: 2023-03-23

Description:
Accepts url link, domain or vault_id (hash) to be detonated using CrowdStrike OAuth API connector. This playbook produces a normalized output for each user and device.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Lou Stella, Splunk
Date: 2024-02-15

Description:
Accepts message ID that needs to be restored to the provided email mailbox in Microsoft Office365. Generates an observable output based on the status of message restoration.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Philip Royer, Splunk
Date: 2021-12-14

Description:
Published in response to CVE-2021-44228, this playbook is meant to be launched after log4j_investigate. In this playbook, the risk from exploited hosts can be mitigated by optionally deleting malicious files from the hosts, blocking outbound network connections from the hosts, and/or shutting down the hosts

References:
  - https://github.com/Neo23x0/Fenrir/blob/master/fenrir.sh
  - https://isc.sans.edu/diary/Log4j++Log4Shell+Followup%3A+What+we+see+and+how+to+defend+%28and+how+to+access+our+data%29/28122
  - https://twitter.com/ElektroWolle/status/[PII_REDACTED]49140224?ref_src=twsrc%5Etfw%7Ctwcamp%5Etweetembed%7Ctwterm%5E[PII_REDACTED]49140224%7Ctwgr%5E%7Ctwcon%5Es1_c10&ref_url=https%3A%2F%2Fpublish.twitter.com%2F%3Fquery%3Dhttps3A2F2Ftwitter.com2FElektroWolle2Fstatus2F[PII_REDACTED]49140224widget%3DTweet
  - https://blog.cloudflare.com/cve-2021-44228-log4j-rce-0-day-mitigation/
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Lou Stella, Splunk
Date: 2023-02-28

Description:
Detects available indicators and routes them to related identifier activity analysis playbooks. The output of the analysis will update any artifacts, tasks, and indicator tags.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Kelby Shelton, Tapish Jain, Splunk
Date: 2025-01-17

Description:
Accepts a URL, IP or Domain and provides intelligence on the objects. Generates a per observable report that includes the objects threat level, threat categories, acceptable use categories and score.

References:
  - https://d3fend.mitre.org/technique/d3f:IdentifierReputationAnalysis/
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Christian Cloutier, Splunk
Date: 2025-06-09

Description:
Accepts a hostname or device id as well as a file path as input and deletes the file from a device in Crowdstrike. We then generate an observable report as well as a Markdown formatted report. Both reports can be customized based on user preference.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Philip Royer, Splunk
Date: 2021-12-14

Description:
Investigate an internal unix host using SSH. This pushes a bash script to the endpoint and runs it, collecting generic information about the processes, user activity, and network activity. This includes the process list, login history, cron jobs, and open sockets. The results are zipped up in .csv files and added to the vault for an analyst to review.

References:
  - https://github.com/Neo23x0/Fenrir/blob/master/fenrir.sh
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Christian Cloutier, Splunk
Date: 2025-06-09

Description:
Given either a CrowdStrike device id (agentId) or a hostname, will query the device to get the other missing attribute.  This enables finding the hostname from a device id or the device id from a hostname and can be used in front of other CrowdStrike custom playbooks for added flexibility.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Lou Stella, Splunk
Date: 2023-06-21

Description:
Accepts user, to be enabled using Azure AD Graph connector. This playbook produces a normalized observables output for each user.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2023-02-28

Description:
Accepts a user or device and identifies if related tickets exists in a timeframe of last 30 days. Generates a global report and list of observables.

References:
  - https://d3fend.mitre.org/technique/d3f:IdentifierReputationAnalysis/
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Lou Stella, Splunk
Date: 2024-02-19

Description:
Accepts an Internet Message ID, searches for its presence in up to 500 mailboxes, and then deletes the ones it finds. GMail does not have a "soft-delete" option, messages run through the Message Eviction playbook will be permanently deleted.