deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Rico Valdez, Splunk
Date: 2020-01-22

Description:
Monitor for and investigate activities, including the creation or deletion of hidden shares and file writes, that may be evidence of infiltration by North Korean government-sponsored cybercriminals. Details of this activity were reported in DHS Report TA-18-149A.

References:
  - https://web.archive.org/web/[PII_REDACTED]4307/https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity
  - https://web.archive.org/web/[PII_REDACTED]2536/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: David Dorsey, Splunk
Date: 2020-01-22

Description:
Detect activities and various techniques associated with the Orangeworm Attack Group, a group that frequently targets the healthcare industry.

References:
  - https://www.symantec.com/blogs/threat-intelligence/orangeworm-targets-healthcare-us-europe-asia
  - https://www.infosecurity-magazine.com/news/healthcare-targeted-by-hacker/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2025-09-09

Description:
PromptLock is a proof-of-concept ransomware identified by ESET in August 2025, marking the first known instance of malware utilizing generative artificial intelligence (GenAI) for attack execution. Unlike traditional ransomware, PromptLock employs a locally hosted AI language model, specifically OpenAI's gpt-oss:20b, accessed via the Ollama API, to dynamically generate malicious Lua scripts in real time. These scripts are compatible across multiple platforms, including Windows, Linux, and macOS. During an infection, PromptLock autonomously determines which files to target for exfiltration or encryption based on predefined prompts, allowing it to adapt its behavior to the environment. The malware utilizes the SPECK 128-bit encryption algorithm and is written in Golang. While ESET considers PromptLock a proof of concept, its capabilities highlight the potential for AI to significantly enhance the sophistication and adaptability of ransomware attacks.

References:
  - https://x.com/ESETresearch/status/[PII_REDACTED]84718315
  - https://arxiv.org/pdf/2508.20444
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2023-12-12

Description:
Utilize analytics designed to identify and delve into atypical behaviors, potentially associated with the Rhysida Ransomware. Employing these searches enables the detection of irregular patterns or actions within systems or networks, serving as proactive measures to spot potential indicators of compromise or ongoing threats. By implementing these search strategies, security analysts can effectively pinpoint anomalous activities, such as unusual file modifications, deviations in system behavior, that could potentially signify the presence or attempt of Rhysida Ransomware infiltration. These searches serve as pivotal tools in the arsenal against such threats, aiding in swift detection, investigation, and mitigation efforts to counter the impact of the Rhysida Ransomware or similar malicious entities.

References:
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-319a
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2025-01-27

Description:
Leverage searches that allow you to detect and investigate unusual activities that might relate to Windealer Remote Access Trojan (RAT), a versatile malware used for data theft and unauthorized system control. Monitor for signs such as unexpected process token adjustment, abnormal file activity, and unauthorized process execution. Investigate indicators of command-and-control (C2) communications, particularly encrypted or obfuscated traffic patterns. Behavioral analysis and endpoint monitoring can help identify suspicious activities linked to this RAT. Early detection and thorough investigation are essential to mitigate the risks posed by Windealer.

References:
  - https://malpedia.caad.fkie.fraunhofer.de/details/win.windealer
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2024-10-07

Description:
This story covers the tactics of Iran-based cyber actors exploiting U.S. and foreign organizations across multiple sectors, as detailed in CISA Alert AA24-241A. It focuses on their methods of gaining initial access, establishing persistence, and enabling ransomware attacks through vulnerabilities in public-facing networking devices.

References:
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-241a
  - https://gist.github.com/MHaggis/7e67b659af9148fa593cf2402edebb41
  - https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/want-remote-powershell-management-from-your-browser-see-how-pswa/ba-p/255764
  - https://learn.microsoft.com/en-us/powershell/module/powershellwebaccess/?view=winserver2012r2-ps
  - https://arz101.medium.com/hackthebox-acute-ee0308b9b443
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Bhavin Patel, Splunk
Date: 2024-09-24

Description:
Monitor your AWS authentication events using your CloudTrail logs. Searches within this Analytic Story will help you stay aware of and investigate suspicious logins.

References:
  - https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2025-09-18

Description:
APT37 is a North Korean aligned threat actor that continues to evolve its Windows tradecraft by combining a Rust backdoor, a PowerShell stage, and a Python based loader to deploy the FadeStealer surveillance tool. Recent activity relies on spear phishing attachments that deliver Windows shortcut or compiled HTML Help files, which stage artifacts in ProgramData and establish persistence through scheduled tasks and Run key modifications. The campaign centralizes command and control on a single server and uses standard web protocols with Base64 and XOR encoding to move data and instructions.

References:
  - https://www.zscaler.com/blogs/security-research/apt37-targets-windows-rust-backdoor-and-python-loader
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Mauricio Velazco, Bhavin Patel, Splunk
Date: 2024-03-06

Description:
The Okta Account Takeover analytic story encompasses a comprehensive suite of detections aimed at identifying unauthorized access and potential takeover attempts of Okta accounts. This collection leverages diverse data points and behavioral analytics to safeguard user identities and access within cloud environments. Monitor for activities and techniques associated with Account Takeover attacks against Okta tenants.

References:
  - https://attack.mitre.org/techniques/T1586/
  - https://www.imperva.com/learn/application-security/account-takeover-ato/
  - https://www.barracuda.com/glossary/account-takeover
  - https://www.okta.com/customer-identity/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2022-07-27

Description:
Linux Living Off The Land consists of binaries that may be used to bypass local security restrictions within misconfigured systems.

References:
  - https://gtfobins.github.io/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2023-02-16

Description:
Utilize searches that enable you to detect and investigate unusual activities potentially related to the Winter Vivern malicious software. This includes examining multiple timeout executions, scheduled task creations, screenshots, and downloading files through PowerShell, among other indicators.

References:
  - https://cert.gov.ua/article/3761023
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2025-03-14

Description:
Medusa ransomware is a sophisticated malware variant that encrypts victims' files and demands a ransom for decryption. It infiltrates systems through phishing emails, malicious downloads, or exploited vulnerabilities. Once inside, it encrypts files, appends specific extensions, and drops ransom notes with payment instructions. Medusa may also disable security tools, delete backups, and threaten to leak stolen data. Detection methods include monitoring unusual file encryption activity, identifying changes in file extensions, detecting unauthorized system modifications, and analyzing ransom notes. Advanced cybersecurity solutions use behavior-based detection, machine learning, and endpoint protection to identify and block Medusa ransomware before it executes. Regular updates, network monitoring, and employee awareness are crucial for preventing infections.

References:
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Bhavin Patel, Splunk
Date: 2026-01-22

Description:
In March of 2016, adversaries were seen using JexBoss--an open-source utility used for testing and exploiting JBoss application servers. These searches help detect evidence of these attacks, such as network connections to external resources or web services spawning atypical child processes, among others.

References:
  - http://www.deependresearch.org/2016/04/jboss-exploits-view-from-victim.html
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Bhavin Patel, Micheal Haag, Splunk
Date: 2025-09-23

Description:
Attackers were observed to have exploited multiple zero-day vulnerabilities targeting certain Cisco Adaptive Security Appliance (ASA) 5500-X Series devices that were running Cisco Secure Firewall ASA Software with VPN web services enabled to implant malware, execute commands, and potentially exfiltrate data from the compromised devices.

References:
  - https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/
  - https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks
  - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-z5xP8EUB
  - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-http-code-exec-WmfP3h3O
  - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-YROOTUW
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Bhavin Patel, Splunk
Date: 2018-05-31

Description:
Monitor and detect registry changes initiated from remote locations, which can be a sign that an attacker has infiltrated your system.

References:
  - https://redcanary.com/blog/windows-registry-attacks-threat-detection/
  - https://attack.mitre.org/wiki/Technique/T1112
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2024-04-18

Description:
Monitor for activities and techniques associated with Compromised Windows Host attacks. A compromised Windows host refers to a computer system running the Windows operating system that has been infiltrated or attacked by unauthorized parties. Such compromises often result in security breaches, data theft, malware infections, or unauthorized access, posing risks to sensitive information and system integrity.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Bhavin Patel, Splunk
Date: 2020-02-04

Description:
Secure your environment against DNS hijacks with searches that help you detect and investigate unauthorized changes to DNS records.

References:
  - https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html
  - https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/
  - http://www.noip.com/blog/2014/07/11/dynamic-dns-can-use-2/
  - https://www.splunk.com/blog/2015/08/04/detecting-dynamic-dns-domains-in-splunk.html
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2023-10-17

Description:
Cisco has identified active exploitation of a previously unknown vulnerability in the Web User Interface (Web UI) feature of Cisco IOS XE software (CVE-2023-20198) when exposed to the internet or untrusted networks. Successful exploitation of this vulnerability allows an attacker to create an account on the affected device with privilege level 15 access, effectively granting them full control of the compromised device and allowing possible subsequent unauthorized activity.

References:
  - https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Mauricio Velazco, Splunk
Date: 2021-12-20

Description:
Monitor for activities and techniques associated with the exploitation of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller Impersonation (CVE-2021-42287) vulnerabilities.

References:
  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42278
  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42287
  - https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Teoderick Contreras, Splunk
Date: 2024-03-20

Description:
CVE-2024-21378 exposes a critical vulnerability in Microsoft Outlook, allowing for authenticated remote code execution (RCE) through the manipulation of synced form objects. Discovered by NetSPI in 2023, this vulnerability capitalizes on the unchanged syncing capability of form objects, despite previous patches aimed at securing script code in custom forms. This technical blog delves into the discovery and weaponization of CVE-2024-21378, enhancing the Outlook penetration testing tool, Ruler, to exploit this flaw. A forthcoming pull request will provide a proof-of-concept code, aiding organizations in mitigating this security risk.

References:
  - https://www.netspi.com/blog/technical/red-team-operations/microsoft-outlook-remote-code-execution-cve-2024-21378/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Mauricio Velazco, Splunk
Date: 2022-02-02

Description:
Monitor for activities and techniques associated with Kerberos based attacks within with Active Directory environments.

References:
  - https://en.wikipedia.org/wiki/Kerberos_(protocol)
  - https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-kile/2a32282e-dd48-4ad9-a542-609804b02cc9
  - https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html
  - https://stealthbits.com/blog/cracking-active-directory-passwords-with-as-rep-roasting/
  - https://attack.mitre.org/techniques/T1558/003/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2025-12-17

Description:
PromptFlux is a POC malware sample that abuses Gemini-like services for command-and-control operations. It achieves persistence by dropping executables or scripts in startup folders and frequently accesses the Gemini API using hard-coded keys or unauthorized requests, often from non-standard processes. The malware also stages payloads, configuration files, or encrypted prompts in temporary directories such as TMP, leaving forensic artifacts. Detection involves monitoring these locations, tracking anomalous API calls, and observing unusual outbound traffic or process injections, enabling early identification and mitigation.

References:
  - https://cloud.google.com/blog/topics/threat-intelligence/threat-actor-usage-of-ai-tools
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2021-02-11

Description:
Monitor and detect techniques used by attackers who leverage the mshta.exe process to execute malicious code.

References:
  - https://redcanary.com/blog/introducing-atomictestharnesses/
  - https://attack.mitre.org/techniques/T1218/001/
  - https://docs.microsoft.com/en-us/windows/win32/api/htmlhelp/nf-htmlhelp-htmlhelpa
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Rico Valdez, Splunk
Date: 2026-01-22

Description:
Detect and investigate activities--such as unusually long `Content-Type` length, suspicious java classes and web servers executing suspicious processes--consistent with attempts to exploit Apache Struts vulnerabilities.

References:
  - https://github.com/SpiderLabs/owasp-modsecurity-crs/blob/v3.2/dev/rules/REQUEST-944-APPLICATION-ATTACK-JAVA.conf
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2025-05-14

Description:
This analytic story addresses the emerging threat of Fake CAPTCHA and ClickFix campaigns that exploit users' familiarity with verification systems to deliver malware through clipboard manipulation techniques. First observed in early 2024 and increasing through 2025, these campaigns use deceptive interfaces that mimic legitimate CAPTCHA systems to trick users into executing malicious commands.

References:
  - https://urlhaus.abuse.ch/
  - https://www.proofpoint.com/us/blog/threat-insight/security-brief-clickfix-social-engineering-technique-floods-threat-landscape
  - https://reliaquest.com/blog/using-captcha-for-compromise/
  - https://attack.mitre.org/techniques/T1204/001/
  - https://github.com/MHaggis/ClickGrab
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Gowthamaraj Rajendran, Bhavin Patel,  Splunk
Date: 2022-08-19

Description:
Identify activity and techniques associated with accessing credential files from AWS resources, monitor unusual authentication related activities to the AWS Console and other services such as RDS.

References:
  - https://attack.mitre.org/tactics/TA0006/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2025-08-18

Description:
Leverage searches that allow you to detect and investigate unusual activities that might relate to Nexus, Chinese state-nexus adversaries known for its stealth and strategic targeting of high-value sectors. Monitor for indicators such as spear-phishing campaigns, exploitation of zero-day vulnerabilities, and unauthorized lateral movement within your network. Investigate anomalous data exfiltration, encrypted communications, and behaviors aligning with their known tactics, techniques, and procedures (TTPs). Combining threat intelligence with real-time monitoring helps identify and respond to Nexus APT activity, minimizing potential damage and data loss. This includes TTPs for groups such as APT31, APT40, and more. Also covers UNC groups such as UNC3886.

References:
  - https://news.sophos.com/en-us/2024/10/31/pacific-rim-neutralizing-china-based-threat/
  - https://www.wsj.com/tech/cybersecurity/typhoon-china-hackers-military-weapons-97d4ef95?st=oe1KKi&reflink=desktopwebshare _permalink
  - https://www.judiciary.senate.gov/imo/media/doc/2024-11-19_pm_-_testimony_-_meyers.pdf
  - https://go.crowdstrike.com/rs/281-OBQ-266/images/GlobalThreatReport2024.pdf
  - https://www.crowdstrike.com/adversaries/envoy-panda/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2024-11-18

Description:
This following analytic story contains detections related to the PXA Stealer, a malicious software tool designed to covertly extract sensitive information from infected systems. This data-stealing malware targets credentials, personal data, browsing information, and financial information by exploiting system vulnerabilities or tricking users into downloading it via phishing campaigns or malicious links. PXA Stealer often operates stealthily, bypassing security measures and transmitting stolen data to cybercriminals. Its capabilities make it a significant threat to individuals and organizations, emphasizing the need for robust cybersecurity defenses and awareness.

References:
  - https://blog.talosintelligence.com/new-pxa-stealer/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2026-01-22

Description:
Detects tactics, techniques, and procedures (TTPs) associated with Scattered Spider (UNC3944, Octo Tempest, Storm-0875),  a sophisticated cybercriminal group targeting large enterprises through advanced social engineering and legitimate tool abuse.  This analytic story provides comprehensive detection coverage for their complete attack chain, from initial social engineering  campaigns through data exfiltration and ransomware deployment. The group is known for bypassing traditional security controls  by abusing legitimate remote access tools like TeamViewer, AnyDesk, and Ngrok, while conducting sophisticated vishing operations  to compromise IT helpdesks and steal MFA tokens.

Recent intelligence from the July 2025 CISA advisory reveals significant evolution in their capabilities, including deployment  of DragonForce ransomware, enhanced Snowflake database targeting for rapid data exfiltration, and advanced cloud infrastructure  exploitation. The analytics in this story detect their signature behaviors including MFA bombing attacks, unauthorized remote  access tool deployment, cloud API abuse, credential harvesting with tools like Mimikatz, and their unique operational security  practices of monitoring victim communications to evade detection. Coverage includes process monitoring, network analytics,  cloud API detection, and behavioral detections designed to identify the subtle indicators that traditional signature-based  tools miss while providing actionable intelligence for incident response teams.


References:
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a
  - https://attack.mitre.org/groups/G1015/
  - https://www.crowdstrike.com/blog/scattered-spider-attempts-to-avoid-detection-with-bring-your-own-vulnerable-driver-tactic/
  - https://www.trellix.com/en-us/about/newsroom/stories/research/scattered-spider-the-modus-operandi.html
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2025-07-30

Description:
Monitors for behaviors associated with Remote Desktop Protocol (RDP) usage on a Windows system, followed by actions consistent with artifact cleanup or defense evasion. When a user initiates an RDP session using the native client (mstsc.exe), Windows generates several artifacts, including Default.rdp in the user’s Documents folder and bitmap cache files (*.bmc, cache*.bin) under the Terminal Server Client cache directory. These files can be valuable for forensic analysis, as they indicate remote access activity and may sometimes reveal details about the accessed system’s graphical environment.

References:
  - https://medium.com/@bonguides25/how-to-clear-rdp-connections-history-in-windows-cf0ffb67f344
  - https://thelocalh0st.github.io/posts/rdp/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Rico Valdez, Splunk
Date: 2017-09-18

Description:
Attackers often attempt to hide within or otherwise abuse the domain name system (DNS). You can thwart attempts to manipulate this omnipresent protocol by monitoring for these types of abuses.

References:
  - http://blogs.splunk.com/2015/10/01/random-words-on-entropy-and-dns/
  - http://www.darkreading.com/analytics/security-monitoring/got-malware-three-signs-revealed-in-dns-traffic/d/d-id/1139680
  - https://live.paloaltonetworks.com/t5/Threat-Vulnerability-Articles/What-are-suspicious-DNS-queries/ta-p/71454