deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2024-09-24

Description:
Spring4Shell is the nickname given to a zero-day vulnerability in the Spring Core Framework, a programming and configuration model for Java-based enterprise applications.

References:
  - https://www.tenable.com/blog/spring4shell-faq-spring-framework-remote-code-execution-vulnerability
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Rod Soto, Teoderick Contreras, Splunk
Date: 2021-04-20

Description:
Leverage searches that allow you to detect and investigate unusual activities that might relate to the trickbot banking trojan, including looking for file writes associated with its payload, process injection, shellcode execution and data collection even in LDAP environment.

References:
  - https://en.wikipedia.org/wiki/Trickbot
  - https://blog.checkpoint.com/2021/03/11/february-2021s-most-wanted-malware-trickbot-takes-over-following-emotet-shutdown/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Rod Soto, Splunk
Date: 2025-11-12

Description:
Leverage advanced Splunk searches to detect and investigate suspicious activities targeting possibly unauthorized local LLM frameworks. This analytic story addresses discovery and detection of unauthorized local LLM frameworks and related shadow AI artifacts. 


References:
  - https://splunkbase.splunk.com/app/8024
  - https://www.ibm.com/think/topics/shadow-ai
  - https://www.splunk.com/en_us/blog/artificial-intelligence/splunk-technology-add-on-for-ollama.html
  - https://blogs.cisco.com/security/detecting-exposed-llm-servers-shodan-case-study-on-ollama
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2025-07-16

Description:
Leverage searches that help you detect and investigate unusual activities potentially associated with Quasar RAT. These includes processes accessing FileZilla XML configuration files (which may store FTP credentials for exfiltration), loading Mozilla NSS and Mozglue libraries (often targeted for DLL side-loading attacks to evade detection), steal credential via browsers and accessing Intelliform Storage Registry keys used by Internet Explorer (which can contain saved credentials and autocomplete data valuable for credential theft).

References:
  - https://malpedia.caad.fkie.fraunhofer.de/details/win.quasar_rat
  - https://www.proofpoint.com/us/blog/threat-insight/around-world-90-days-state-sponsored-actors-try-clickfix
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2021-11-17

Description:
Leverage searches that allow you to detect and investigate unusual activities that might correlate to insider threat specially in terms of information sabotage.

References:
  - https://insights.sei.cmu.edu/blog/insider-threat-deep-dive-it-sabotage/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2024-01-16

Description:
The following analytic story addresses critical vulnerabilities CVE-2023-46805 and CVE-2024-21887 in Ivanti Connect Secure and Ivanti Policy Secure Gateways. CVE-2023-46805 is an authentication bypass vulnerability, while CVE-2024-21887 is a command injection flaw, both presenting significant risks in versions 9.x and 22.x. Combined, these vulnerabilities enable unauthenticated threat actors to execute arbitrary commands, compromising system integrity. Immediate mitigation is imperative, with patches scheduled for staggered release. Ivanti has provided interim mitigation steps, and it's crucial for customers to apply these measures to protect their systems against potential exploits.

References:
  - https://github.com/RootUp/PersonalStuff/blob/master/http-vuln-cve2023-46805_2024_21887.nse
  - https://github.com/projectdiscovery/nuclei-templates/blob/c6b351e71b0fb0e40e222e97038f1fe09ac58194/http/misconfiguration/ivanti/CVE-2023-46085-CVE-2024-21887-mitigation-not-applied.yaml
  - https://github.com/rapid7/metasploit-framework/pull/18708/files
  - https://attackerkb.com/topics/AdUh6by52K/cve-2023-46805/rapid7-analysis
  - https://labs.watchtowr.com/welcome-to-2024-the-sslvpn-chaos-continues-ivanti-cve-2023-46805-cve-2024-21887/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2024-09-24

Description:
Monitor and detect techniques used by attackers who leverage the mshta.exe process to execute malicious code.

References:
  - https://attack.mitre.org/techniques/T1218/009/
  - https://github.com/rapid7/metasploit-framework/blob/master/documentation/modules/evasion/windows/applocker_evasion_regasm_regsvcs.md
  - https://oddvar.moe/2017/12/13/applocker-case-study-how-insecure-is-it-really-part-1/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, splunk
Date: 2024-03-26

Description:
APT29, a sophisticated threat actor linked to the Russian SVR, has expanded its cyber espionage activities to target European diplomats and German political parties. Utilizing a novel backdoor variant, WINELOADER, these campaigns leverage diplomatic-themed lures to initiate infection chains, demonstrating APT29's evolving tactics and interest in geopolitical intelligence. The operations, marked by their low volume and high precision, underscore the broad threat APT29 poses to Western political and diplomatic entities.

References:
  - https://www.mandiant.com/resources/blog/apt29-wineloader-german-political-parties
  - https://www.zscaler.com/blogs/security-research/european-diplomats-targeted-spikedwine-wineloader
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2023-11-09

Description:
A zero-day vulnerability was discovered in SysAid's on-premise software, exploited by the group DEV-0950 (Lace Tempest). The attackers uploaded a WebShell and other payloads, gaining unauthorized access and control. SysAid has released a patch (version 23.3.36) to remediate the vulnerability and urges customers to conduct a comprehensive compromise assessment.

References:
  - https://www.sysaid.com/blog/service-desk/on-premise-software-security-vulnerability-notification
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Dean Luxton, Mauricio Velazco, Splunk
Date: 2024-03-14

Description:
Monitor for activities and techniques associated with Windows Active Directory persistence techniques.

References:
  - https://adsecurity.org/?p=1929
  - https://www.youtube.com/watch?v=Lz6haohGAMc&feature=youtu.be
  - https://adsecurity.org/wp-content/uploads/2015/09/DEFCON23-2015-Metcalf-RedvsBlue-ADAttackAndDefense-Final.pdf
  - https://attack.mitre.org/tactics/TA0003/
  - https://www.dcshadow.com
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Raven Tait, Splunk
Date: 2026-02-26

Description:
This analytic story identifies popular MacOS post exploitation tools such as MacPEAS, MacShellSwift, EvilOSX, chainbreaker, etc

References:
  - https://attack.mitre.org/matrices/enterprise/macos/
  - https://github.com/UnsaltedHash42/macPEAS
  - https://github.com/cedowens/MacShellSwift/tree/master/MacShellSwift
  - https://github.com/Marten4n6/EvilOSX
  - https://github.com/n0fate/chainbreaker
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2023-10-01

Description:
A critical security vulnerability, CVE-2023-42793, has been discovered affecting all versions of TeamCity On-Premises up to 2023.05.3. This vulnerability allows unauthenticated attackers to execute remote code and gain administrative control of the TeamCity server, posing a significant risk for supply chain attacks. Although the issue has been fixed in version 2023.05.4, servers running older versions remain at risk. A security patch plugin has been released for immediate mitigation, applicable to TeamCity versions 8.0 and above. Organizations are strongly advised to update to the fixed version or apply the security patch, especially if their TeamCity server is publicly accessible. No impact has been reported on TeamCity Cloud as it has been upgraded to the secure version.

References:
  - https://blog.jetbrains.com/teamcity/2023/09/critical-security-issue-affecting-teamcity-on-premises-update-to-2023-05-4-now/
  - https://www.sonarsource.com/blog/teamcity-vulnerability/
  - https://github.com/rapid7/metasploit-framework/pull/18408
  - https://attackerkb.com/topics/1XEEEkGHzt/cve-2023-42793/rapid7-analysis
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: David Dorsey, Splunk
Date: 2019-10-02

Description:
Monitor your cloud compute instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or compute instances started by previously unseen users are just a few examples of potentially malicious behavior.

References:
  - https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Raven Tait, Splunk
Date: 2026-01-05

Description:
Leverage advanced Splunk searches to detect and investigate suspicious user agent strings on the network, including malware, command and control frameworks, RMM software, and other unwanted programs.

References:
  - https://github.com/BC-SECURITY/Malleable-C2-Profiles
  - https://www.keysight.com/blogs/en/tech/nwvs/2021/07/28/koadic-c3-command-control-decoded
  - https://github.com/mthcht/awesome-lists/blob/main/Lists/suspicious_http_user_agents_list.csv
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Bhavin Patel, Michael Haag, Splunk
Date: 2021-01-20

Description:
Monitor and detect techniques used by attackers who leverage the mshta.exe process to execute malicious code.

References:
  - https://redcanary.com/blog/introducing-atomictestharnesses/
  - https://redcanary.com/blog/windows-registry-attacks-threat-detection/
  - https://attack.mitre.org/techniques/T1218/005/
  - https://medium.com/@mbromileyDFIR/malware-monday-aebb456356c5
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2023-07-26

Description:
A critical vulnerability has been discovered in ShareFile's Storage Zones Controller software (CVE-2023-24489), used by numerous organizations for file sharing and storage. The vulnerability allows unauthenticated arbitrary file upload and remote code execution due to a cryptographic bug in the software's encryption but lack of authentication system. The risk comes from a failing encryption check, allowing potential cybercriminals to upload malicious files to the server. The bug was found in the Documentum Connector's .aspx files. The security risk has a potentially large impact due to the software's wide use and the sensitivity of the stored data. Citrix has released a security update to address this issue.

References:
  - https://www.greynoise.io/blog/introducing-cve-2023-24489-a-critical-citrix-sharefile-rce-vulnerability
  - https://blog.assetnote.io/2023/07/04/citrix-sharefile-rce/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Nasreddine Bencherchali, Splunk
Date: 2026-03-02

Description:
This analytic story provides a suite of detections designed to analyze logs collected from Cisco Catalyst SD-WAN devices.
The included analytics focus on identifying anomalous control connections, unexpected peer relationships, rare peer-type and system-IP combinations, suspicious public IP associations, and other deviations from established SD-WAN topology behavior.
These detections help security teams surface unauthorized devices, misconfigurations, infrastructure drift, and potential exploitation attempts targeting SD-WAN components.


References:
  - https://www.cisa.gov/news-events/directives/supplemental-direction-ed-26-03-hunt-and-hardening-guidance-cisco-sd-wan-systems
  - https://blog.talosintelligence.com/uat-8616-sd-wan/
  - https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/Monitor-And-Maintain/monitor-maintain-book/m-alarms-events-logs.html
  - https://www.cisco.com/c/en/us/td/docs/routers/sdwan/17-x/systems-interfaces/systems-interfaces-guide-17-x/system-logging.html#config-sys-logging
  - https://sec.cloudapps.cisco.com/security/center/resources/Cisco-Catalyst-SD-WAN-HardeningGuide
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2024-06-25

Description:
Monitor for activities and techniques associated with Compromised Linux Host attacks. These include unauthorized access attempts, unusual network traffic patterns, and the presence of unknown or suspicious processes. Look for unexpected changes in system files, modifications to configuration files, and the installation of unrecognized software. Pay attention to abnormal resource usage, such as high CPU or memory consumption. Regularly review logs for signs of privilege escalation or lateral movement, and ensure integrity checks are in place to detect tampering with critical system components.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2023-07-10

Description:
Leverage searches that allow you to detect and investigate unusual activities that might relate to the BlackByte ransomware, including looking for file writes associated with BlackByte, persistence, initial access, account registry modification and more.

References:
  - https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2025-03-24

Description:
VanHelsing is a rapidly growing ransomware-as-a-service (RaaS) program launched in March 2025. The ransomware targets Windows systems with additional variants for Linux, BSD, ARM, and ESXi systems. It uses various techniques including shadow copy deletion, process hollowing, and command-line arguments to control encryption behavior. Files are encrypted with the .vanhelsing extension, and a ransom note (README.txt) is dropped in each folder.

References:
  - https://research.checkpoint.com/2025/vanhelsing-new-raas-in-town/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Raven Tait, Splunk
Date: 2025-12-04

Description:
Tuoni is a sophisticated, cross-platform red teaming framework designed to enhance cybersecurity education and training through large-scale cyber defense exercises.

References:
  - https://github.com/shell-dot/tuoni
  - https://www.infosecurity-magazine.com/news/ai-tuoni-framework-targets-us-real/
  - https://cybersecuritynews.com/hackers-using-leverage-tuoni-c2-framework-tool/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2023-03-30

Description:
On March 29, 2023, CrowdStrike Falcon OverWatch observed unexpected malicious activity emanating from a legitimate, signed binary, 3CXDesktopApp,  a softphone application from 3CX. The malicious activity includes beaconing to actor controlled infrastructure, deployment of second stage payloads, and, in a small number of cases, hands on keyboard activity. (CrowdStrike)

References:
  - https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/
  - https://www.cisa.gov/news-events/alerts/2023/03/30/supply-chain-attack-against-3cxdesktopapp
  - https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/
  - https://www.3cx.com/community/threads/crowdstrike-endpoint-security-detection-re-3cx-desktop-app.119934/page-2#post-558898
  - https://www.3cx.com/community/threads/3cx-desktopapp-security-alert.119951/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2023-06-01

Description:
A critical zero-day vulnerability has been discovered in the MOVEit Transfer file transfer software, widely used by businesses and developers worldwide. The vulnerability has been exploited by unknown threat actors to perform mass data theft from organizations. Progress Software Corporation, the developer of MOVEit, has issued a security advisory urging customers to take immediate action to protect their environments. They recommend blocking external traffic to ports 80 and 445 on the MOVEit server, and to check the c:\MOVEitTransfer\wwwroot\ folder for unusual files. A patch is currently released.

References:
  - https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023
  - https://www.reddit.com/r/sysadmin/comments/13wxuej/critical_vulnerability_moveit_file_transfer/
  - https://www.bleepingcomputer.com/news/security/new-moveit-transfer-zero-day-mass-exploited-in-data-theft-attacks/
  - https://www.reddit.com/r/sysadmin/comments/13wxuej/critical_vulnerability_moveit_file_transfer/
  - https://gist.github.com/MHaggis/faa672b1929a23fc48fc0ee47585cc48
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Nasreddine Bencherchali, splunk
Date: 2025-10-23

Description:
Leverage searches that allow you to detect and investigate unusual activities
that might relate to the exploitation of Oracle E-Business Suite vulnerabilities (CVE-2025-61882 and CVE-2025-61884).


References:
  - https://www.oracle.com/security-alerts/alert-cve-2025-61882.html
  - https://www.oracle.com/security-alerts/alert-cve-2025-61884.html
  - https://labs.watchtowr.com/well-well-well-its-another-day-oracle-e-business-suite-pre-auth-rce-chain-cve-2025-61882well-well-well-its-another-day-oracle-e-business-suite-pre-auth-rce-chain-cve-2025-61882/
  - https://cloud.google.com/blog/topics/threat-intelligence/oracle-ebusiness-suite-zero-day-exploitation
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2023-06-21

Description:
CVE-2023-20887 is a critical vulnerability affecting VMware's vRealize Network Insight (also known as VMware Aria Operations for Networks). It allows a remote, unauthenticated attacker to execute arbitrary commands with root privileges via the Apache Thrift RPC interface. The exploit, which has a severity score of 9.8, targets an endpoint ("/saas./resttosaasservlet") in the application and delivers a malicious payload designed to create a reverse shell, granting the attacker control over the system. VMware has released an advisory recommending users to update to the latest version to mitigate this threat.

References:
  - https://nvd.nist.gov/vuln/detail/CVE-2023-20887
  - https://summoning.team/blog/vmware-vrealize-network-insight-rce-cve-2023-20887/
  - https://viz.greynoise.io/tag/VMware-aria-operations-for-networks-rce-attempt?days=30
  - https://github.com/sinsinology/CVE-2023-20887
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Shannon Davis, Splunk
Date: 2020-08-02

Description:
Uncover activity consistent with CVE-2020-5902. Discovered by Positive Technologies researchers, this vulnerability affects F5 BIG-IP, BIG-IQ. and Traffix SDC devices (vulnerable versions in F5 support link below). This vulnerability allows unauthenticated users, along with authenticated users, who have access to the configuration utility to execute system commands, create/delete files, disable services, and/or execute Java code.  This vulnerability can result in full system compromise.

References:
  - https://www.ptsecurity.com/ww-en/about/news/f5-fixes-critical-vulnerability-discovered-by-positive-technologies-in-big-ip-application-delivery-controller/
  - https://support.f5.com/csp/article/K52145254
  - https://blog.cloudflare.com/cve-2020-5902-helping-to-protect-against-the-f5-tmui-rce-vulnerability/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2023-04-14

Description:
The first in-the-wild UEFI bootkit bypassing UEFI Secure Boot on fully updated UEFI systems is now a reality

References:
  - https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/
  - https://www.welivesecurity.com/2023/03/01/blacklotus-uefi-bootkit-myth-confirmed/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2025-03-19

Description:
Leverage searches that allow you to detect and investigate unusual activities that might relate to Salt Typhoon, a sophisticated threat actor targeting various sectors with espionage-focused campaigns. Monitor for indicators such as spear-phishing emails, unauthorized access attempts, and lateral movement within your network. Investigate anomalous data exfiltration patterns and command-and-control (C2) traffic consistent with known tactics, techniques, and procedures (TTPs) of this group. Combining threat intelligence with advanced monitoring tools helps identify potential Salt Typhoon activity early, enabling swift response to mitigate risks effectively.

References:
  - https://www.trendmicro.com/en_nl/research/24/k/earth-estries.html
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2025-01-27

Description:
Leverage searches that allow you to detect and investigate unusual activities that might relate to Derusbi malware, a sophisticated threat often linked to advanced persistent attacks. Monitor anomalies in network traffic, file execution patterns, and unauthorized access attempts to uncover potential compromises. Utilize behavioral analytics and endpoint detection tools to identify indicators such as pesistence, service creation, lateral movement via removable drive, driver loading and dll side loading. By correlating these findings with known threat intelligence, you can quickly respond to and mitigate Derusbi-related incidents.

References:
  - https://www.virusbulletin.com/uploads/pdf/conference_slides/2015/Pun-etal-VB2015.pdf
  - https://www.trendmicro.com/en_us/research/21/g/biopass-rat-new-malware-sniffs-victims-via-live-streaming.html
  - https://web.archive.org/web/[PII_REDACTED]3107/https://www.rsaconference.com/writable/presentations/file_upload/hta-w02-dissecting-derusbi.pdf
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Rico Valdez, Splunk
Date: 2018-06-01

Description:
Detect and investigate tactics, techniques, and procedures leveraged by attackers to establish and operate Command And Control channels. Implants installed by attackers on compromised endpoints use these channels to receive instructions and send data back to the malicious operators.

References:
  - https://attack.mitre.org/wiki/Command_and_Control
  - https://searchsecurity.techtarget.com/feature/Command-and-control-servers-The-puppet-masters-that-govern-malware
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2025-03-17

Description:
This analytic story covers attacks exploiting CVE-2024-4577, a remote code execution (RCE) vulnerability in the PHP-CGI implementation on Windows. Attackers leverage this vulnerability to gain initial access, deploy Cobalt Strike using the "TaoWu" kit for post-exploitation activities, and establish persistence. The attacks primarily target organizations across various sectors including technology, telecommunications, entertainment, education, and e-commerce.

References:
  - https://blog.talosintelligence.com/new-persistent-attacks-japan/
  - https://github.com/watchtowrlabs/CVE-2024-4577/blob/main/watchTowr-vs-php_cve-2024-4577.py