deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Jim Apger, Splunk
Date: 2018-10-08

Description:
Monitor your environment for activity consistent with common attack techniques bad actors use when attempting to compromise web servers or other web-related assets.

References:
  - https://www.fbi.gov/scams-and-safety/common-fraud-schemes/internet-fraud
  - https://www.fbi.gov/news/stories/2017-internet-crime-report-released-050718
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Rod Soto, Rico Valdez, Splunk
Date: 2020-02-20

Description:
Use the searches in this story to monitor your Kubernetes registry repositories for upload, and deployment of potentially vulnerable, backdoor, or implanted containers. These searches provide information on source users, destination path, container names and repository names. The searches provide context to address Mitre T1525 which refers to container implantation upload to a company's repository either in Amazon Elastic Container Registry, Google Container Registry and Azure Container Registry.

References:
  - https://github.com/splunk/cloud-datamodel-security-research
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Teoderick Contreras, Splunk
Date: 2025-01-27

Description:
Leverage searches that allow you to detect and investigate unusual activities that might relate to Earth Estries, a sophisticated threat actor targeting various sectors with espionage-focused campaigns. Monitor for indicators such as spear-phishing emails, unauthorized access attempts, and lateral movement within your network. Investigate anomalous data exfiltration patterns and command-and-control (C2) traffic consistent with known tactics, techniques, and procedures (TTPs) of this group. Combining threat intelligence with advanced monitoring tools helps identify potential Earth Estries activity early, enabling swift response to mitigate risks effectively.

References:
  - https://www.trendmicro.com/en_nl/research/24/k/earth-estries.html
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: David Dorsey, Splunk
Date: 2024-09-24

Description:
Identify and investigate prohibited/unauthorized software or processes that may be concealing malicious behavior within your environment.

References:
  - https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/
Sigma Detection Rule: 
Repository: splunk/security_content

Description:
a simple jupyter notebook that helps Splunk Threat Research Team sees the data connections, commonalities and differences of security content stories or threat families.
Sigma Detection Rule: 
Repository: splunk/security_content

Description:
A Jupyter notebook for detecting suspicious DNS TXT records using a pre-trained model in DSDL
Sigma Detection Rule: 
Repository: splunk/security_content

Description:
A Jupyter notebook for detecting DGA domains using a pre-trained model in DSDL
Sigma Detection Rule: 
Repository: splunk/security_content

Description:
A Jupyter notebook for detecting DNS data exfiltration using a pre-trained model in DSDL
Sigma Detection Rule: 
Repository: splunk/security_content

Description:
A Jupyter notebook for detecting suspicious processnames using a pre-trained model in DSDL
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-07-10

Description:
Logs the creation of a new process
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Bhavin Patel, Splunk
Date: 2025-01-14

Description:
Data source object for Splunk CIM
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Michael Haag, Splunk
Date: 2025-01-23

Description:
Logs an event when a Remote Desktop Protocol (RDP) client successfully connects to a remote host.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-07-10

Description:
Logs the creation of a new registry key, including details about the key name, registry path, and associated process metadata.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Bhavin Patel, Splunk
Date: 2023-10-15

Description:
Logs an event when a model invocation logging configuration is deleted within the AWS CloudTrail.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs HTTP/S access events on an Nginx server, including details such as client IP, request method, URI, response status, and user agent.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-07-10

Description:
Logs an event when a token right is adjusted on a Windows system.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs updates made to applications in Microsoft 365, including changes to configurations, permissions, and role assignments.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs the list of installed IIS modules retrieved using PowerShell, including details about their names and statuses.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs the creation of a new snapshot of a cloud resource, such as an Amazon EBS volume, including details about the snapshot ID and resource type.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-07-10

Description:
Logs changes to the properties of a computer account in Active Directory, including details about the modified attributes and the user performing the action.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs user or admin consent to an application's permissions in Azure Active Directory, including details about the application, granted permissions, and the consenting user or process.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs an event when an AWS CloudTrail trail is updated, typically involving changes to settings or configuration.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs TCP traffic captured by Splunk Stream, including details about source and destination IPs, ports, connection states, and packet-level metadata.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs an event when an Azure Active Directory account is enabled.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-07-10

Description:
Logs an event when a Windows Defender attack surface reduction rule fires in block mode.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-07-10

Description:
Logs an event when a user overrides a security policy set by an Attack Surface Reduction rule in Microsoft Defender.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Nasreddine Bencherchali, Splunk
Date: 2026-03-03

Description:
Data source object for Cisco SD-WAN Notification Event 1000001
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs the addition of a new service principal in Microsoft 365, including details about the associated application and the action initiator.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs the addition of mailbox permissions in Microsoft 365, including details about the mailbox, granted permissions, and the user or administrator performing the action.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs the deletion of an account-level password policy in AWS, including details about the account and policy being removed.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Teoderick Contreras, Splunk
Date: 2025-02-20

Description:
Logs system calls made by processes on a Linux system, including details about the syscall number, arguments, return values, and associated process metadata.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-07-10

Description:
Logs an event when a scheduled task is deleted from the system.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Jacob Delgado, SnapAttack
Date: 2025-01-23

Description:
Logs network connection metadata captured by Zeek (formerly Bro), including details such as source and destination IPs, ports, connection state, and protocol.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Data source object for GitHub Webooks
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Nasreddine Bencherchali, Splunk
Date: 2025-04-16

Description:
Data source object for raw intrusion events from Cisco Secure Firewall Threat Defense
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Bryan Pluta, Bhavin Patel, Splunk
Date: 2025-01-23

Description:
Logs security alerts generated by Microsoft Defender for Endpoint, including information about detected threats, impacted devices, and recommended actions.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs the creation of new AWS access keys, including details of the associated user and permissions.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs modifications to folder permissions in Microsoft 365, including updates to access levels, user assignments, and sharing settings.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-07-10

Description:
Logs an enumeration of local group membership on a system, including details about the groups queried and the account performing the action.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-07-10

Description:
Logs changes to the start type of a Windows service, including details about the service name, old start type, and new start type.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2026-04-13

Description:
Logs system queries performed using osquery, including details about processes, file access, network activity, and system configurations.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-07-10

Description:
Logs an event when a successful account logon occurs and displays the list of groups the logged-on account belongs to.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Bhavin Patel, Splunk
Date: 2025-02-21

Description:
Data source object for AWS CloudTrail DeleteRuleGroup
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs the creation of login profiles for IAM users, including associated metadata and authentication settings.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs the creation of a new file on a Linux system, including details about the file path, file type, and associated process.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs an event when a user attempts to sign into Azure Active Directory, capturing authentication details and outcomes.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs the addition of an owner to an application in Azure Active Directory, including details about the application, the owner added, and the user or process performing the action.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs activities within a Kubernetes cluster, including API server requests, resource access, configuration changes, and user authentication events.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Bhavin Patel
Date: 2024-07-18

Description:
Data source object for Cisco AI Defense Alerts
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs an event when a container image is uploaded to a repository in AWS CloudTrail.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-07-10

Description:
Logs changes made to the name of a computer account, including the old and new names and the user performing the action.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs an event in IIS when a module DLL fails to load due to a configuration issue, including details about the module and error message.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs the successful registration of a new scheduled task in Windows Task Scheduler, including task details and configurations.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs the deletion of a log stream within a CloudWatch log group, including details about the stream name and associated log group.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs an event when a new job is created in AWS CloudTrail.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Bhavin Patel, Splunk
Date: 2025-07-10

Description:
Data source object for Windows Event Log Security 4728
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Bhavin Patel, Splunk
Date: 2025-07-10

Description:
Data source object for Windows Event Log Defender 1132
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs the creation of new AWS KMS keys, including details of key properties and associated metadata.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Teoderick Contreras, Splunk
Date: 2025-02-20

Description:
Logs activities related to the addition of a new user account on a Linux system, including details about the username, UID, and the process initiating the action.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Bhavin Patel, Splunk
Date: 2025-07-10

Description:
Data source object for Windows Event Log Security 4737
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs an event when an external user is invited to join an Azure Active Directory tenant.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Nasreddine Bencherchali, Splunk
Date: 2025-06-30

Description:
Data source object for OSquery events from Cisco Network Visibility Module
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2026-03-31

Description:
Logs detected threats identified by Palo Alto Networks devices, including details about malware, intrusion attempts, and malicious network activity.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs HTTP traffic captured by Splunk Stream, including details such as request methods, URLs, headers, response codes, and client-server interactions.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-07-10

Description:
Logs the deletion of an Active Directory object, including details about the object name, type, and the user performing the action.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Teoderick Contreras, Splunk
Date: 2025-06-06

Description:
Logs the execution of processes on a Linux system, including details about the auditd daemon status.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-15

Description:
Data source object for GitHub Organizations logs using the Splunk Add-on for Github using a Personal Access Token.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Bhavin Patel, Splunk
Date: 2025-07-10

Description:
Data source object for Windows Event Log Security 4749
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs the assignment of an application role grant to a user in Microsoft 365, including details about the role, user, and application involved.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-07-10

Description:
Logs an event when a user account's properties, such as permissions or memberships, are modified on a Windows system.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-07-10

Description:
Logs details of network connections initiated by processes, including source and destination IPs, ports, protocols, and the associated process metadata.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs the creation of a new virtual multi-factor authentication (MFA) device, including details about the associated user and configuration.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Bhavin Patel, Splunk
Date: 2025-07-10

Description:
Data source object for Windows Event Log Printservice 4909
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs an event when findings from an image vulnerability scan are described using the DescribeImageScanFindings operation in AWS CloudTrail.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Teoderick Contreras, Splunk
Date: 2025-02-20

Description:
Logs the full command-line arguments of a process execution on a Linux system, providing visibility into the executed command and its parameters.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Bhavin Patel, Splunk
Date: 2025-07-10

Description:
Data source object for Windows Event Log Security 4730
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs an event when a new Azure Automation Runbook is created or an existing one is updated.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Bhavin Patel, Splunk
Date: 2026-02-25

Description:
Captures firewall connection events from Cisco Secure Access including user identity, source and destination metadata, protocol details, and session statistics. Enables analysis of network traffic patterns, access policy enforcement, brute force attempts, and anomalous connection behavior across cloud-managed network access infrastructure.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-07-10

Description:
Logs NTLM authentication attempts, including details about the account name, authentication status, and the originating workstation.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs the assignment of an application role to a service principal in Microsoft 365, including details about the role, service principal, and application involved.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Bhavin Patel, Splunk
Date: 2025-07-10

Description:
Data source object for Windows Event Log Defender 1125
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs an event when a request is made to get the account password policy in AWS CloudTrail.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Bhavin Patel, Splunk
Date: 2025-11-18

Description:
Captures kernel probe (kprobe) telemetry from Cisco Isovalent Runtime Security, including function name, arguments, and process context, enabling visibility into low-level kernel interactions that may indicate container escape attempts or system tampering.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs the deletion of an AWS CloudTrail trail, including details about the trail name and its associated logging configurations.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Bhavin Patel, Splunk
Date: 2025-02-21

Description:
Data source object for Azure Active Directory NonInteractiveUserSignInLogs
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Teoderick Contreras, Splunk
Date: 2025-07-10

Description:
Data source object for Windows Event Log Security 4947
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-07-10

Description:
Logs the deletion of a user account, including details about the account name, associated domain, and the account performing the action.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Jacob Delgado, SnapAttack
Date: 2025-01-23

Description:
Logs SSL/TLS handshake and session details captured by Zeek (formerly Bro), including certificates, cipher suites, and session information.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Bhavin Patel, Splunk
Date: 2025-07-10

Description:
Data source object for Windows Event Log Defender 1126
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-07-10

Description:
Sysmon EventID 17 logs details about the detection of a named pipe.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Rod Soto, Splunk
Date: 2025-10-07

Description:
M365 exported eDiscovery prompt logs from Microsoft Purview contain user interactions with M365 Copilot, including the actual prompt text (Subject_Title), sender information, timestamps, and metadata about the AI conversations. These logs are exported through Purview's eDiscovery functionality and provide visibility into how users are querying and attempting to interact with Copilot, making them valuable for detecting jailbreak attempts, data exfiltration requests, policy violations, and other security-relevant AI usage patterns. The logs capture the full conversational context necessary for identifying malicious prompt injection, social engineering attempts against the AI, and unauthorized information disclosure requests.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Bhavin Patel, Splunk
Date: 2025-02-21

Description:
Data source object for Google Workspace
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Nasreddine Bencherchali, Splunk
Date: 2025-12-02

Description:
This type is used to record the working directory from which the process that invoked the system call specified in the first record was executed. The purpose of this record is to record the current process's location in case a relative path winds up being captured in the associated PATH record. This way the absolute path can be reconstructed.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs an event when a Web Access Control List (WebACL) is deleted in AWS CloudTrail.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Bhavin Patel, Splunk
Date: 2025-07-10

Description:
Data source object for Windows Event Log Security 4790