deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2024-02-21

Description:
This analytic story provides a comprehensive overview of the ConnectWise ScreenConnect vulnerabilities.

References:
  - https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
  - https://www.huntress.com/blog/detection-guidance-for-connectwise-cwe-288-2
  - https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2022-02-14

Description:
Leverage searches that allow you to detect and investigate unusual activities that might relate to the network discovery, including looking for network configuration, settings such as IP, MAC address, firewall settings and many more.

References:
  - https://attack.mitre.org/techniques/T1016/
  - https://www.welivesecurity.com/wp-content/uploads/2021/01/ESET_Kobalos.pdf
  - https://researchcenter.paloaltonetworks.com/2018/09/unit42-xbash-combines-botnet-ransomware-coinmining-worm-targets-linux-windows/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2022-07-27

Description:
Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information.

References:
  - https://attack.mitre.org/techniques/T1014/
  - https://content.fireeye.com/apt-41/rpt-apt41
  - https://medium.com/chronicle-blog/winnti-more-than-just-windows-and-gates-e4f03436031a
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Nasreddine Bencherchali, Splunk
Date: 2025-05-05

Description:
The AMOS Stealer analytic story provides detection and investigation content for identifying and responding to threats associated with the AMOS information stealer on Mac systems. AMOS (Atomic macOS Stealer) is a known malware family designed specifically for MacOS, capable of stealing credentials, system information, and browser data. This story leverages analytics using osquery data to detect suspicious behavior consistent with AMOS, including VM detection commands used to evade analysis environments. Security teams can use the searches in this story to identify and respond to signs of AMOS compromise in their MacOS fleet.

References:
  - https://malpedia.caad.fkie.fraunhofer.de/details/osx.amos
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Patrick Bareiss, Splunk
Date: 2025-01-14

Description:
Leverage searches that allow you to detect and investigate suspicious GitHub activities that might indicate malicious behavior, including pull requests from unknown users, disabled security workflows, and other potentially harmful repository modifications. These detections help identify attempts to compromise repositories through unauthorized code changes, bypassed security controls, and other suspicious actions that could lead to supply chain attacks or data breaches.

References:
  - https://www.googlecloudcommunity.com/gc/Community-Blog/Monitoring-for-Suspicious-GitHub-Activity-with-Google-Security/ba-p/763610
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2022-11-30

Description:
This analytic story identifies popular Windows post exploitation tools for example winpeas.bat, winpeas.exe, WinPrivCheck.bat and many more.

References:
  - https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Hart, Splunk
Date: 2021-03-04

Description:
Monitors for behaviors associated with adversaries discovering objects in the environment that can be leveraged in the progression of the attack.

References:
  - https://attack.mitre.org/tactics/TA0007/
  - https://cyberd.us/penetration-testing
  - https://attack.mitre.org/software/S0521/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2023-10-10

Description:
Adversaries may tamper with SIP and trust provider components to mislead the operating system and application control tools when conducting signature validation checks. This technique involves modifying the Dll and FuncName Registry values that point to the dynamic link library (DLL) providing a SIP's function, which retrieves an encoded digital certificate from a signed file. By pointing to a maliciously-crafted DLL with an exported function that always returns a known good signature value, an adversary can apply an acceptable signature value to all files using that SIP. This can also enable persistent code execution, since these malicious components may be invoked by any application that performs code signing or signature validation.

References:
  - https://attack.mitre.org/techniques/T1553/003/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_sip_persistence.yml
  - https://specterops.io/wp-content/uploads/sites/3/2022/06/SpecterOps_Subverting_Trust_in_Windows.pdf
  - https://github.com/gtworek/PSBits/tree/master/SIP
  - https://github.com/mattifestation/PoCSubjectInterfacePackage
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Rico Valdez, Splunk
Date: 2018-01-26

Description:
Detect and investigate suspected abuse of file extensions and Windows file associations. Some of the malicious behaviors involved may include inserting spaces before file extensions or prepending the file extension with a different one, among other techniques.

References:
  - https://blog.malwarebytes.com/cybercrime/2013/12/file-extensions-2/
  - https://attack.mitre.org/wiki/Technique/T1042
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2024-03-04

Description:
This story provides a high-level overview of JetBrains TeamCity vulnerabilities and how to detect and respond to them using Splunk.

References:
  - https://www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/
  - https://blog.jetbrains.com/teamcity/2024/03/teamcity-2023-11-4-is-out/
  - https://blog.jetbrains.com/teamcity/2024/03/additional-critical-security-issues-affecting-teamcity-on-premises-cve-2024-27198-and-cve-2024-27199-update-to-2023-11-4-now/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2023-06-12

Description:
The MITRE ATT&CK technique T1053 refers to Scheduled Task/Job. Adversaries might use task scheduling utilities to execute programs or scripts at a predefined date and time. This method is often used for persistence but can also be used for privilege escalation or to execute tasks under certain conditions. Scheduling tasks can be beneficial for an attacker as it can allow them to execute actions at times when the system is less likely to be monitored actively. Different operating systems have different utilities for task scheduling, for example, Unix-like systems have Cron, while Windows has Scheduled Tasks and At Jobs.

References:
  - https://attack.mitre.org/techniques/T1053/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2025-07-28

Description:
Leverage searches that allow you to detect and investigate unusual activities associated with Interlock Ransomware, such as unexpected file encryption patterns, anomalous process execution (e.g., PowerShell or CMD spawning from Office applications), and large-scale file renaming. Look for indicators including creation of ransom notes (e.g.,  !__README__!.txt), high volumes of file modifications in short time spans, and suspicious outbound connections to command-and-control infrastructure. Correlate these behaviors with privilege escalation attempts, scheduled tasks or registry changes, and endpoint detections tied to known Interlock payloads. Implement behavioral analytics and MITRE ATT&CK mappings (e.g., T1486 - Data Encrypted for Impact) to surface early signs of ransomware activity before full encryption occurs.

References:
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-203a
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Bhavin Patel, Splunk
Date: 2020-02-03

Description:
Leveraging the Windows command-line interface (CLI) is one of the most common attack techniques--one that is also detailed in the MITRE ATT&CK framework. Use this Analytic Story to help you identify unusual or suspicious use of the CLI on Windows systems.

References:
  - https://attack.mitre.org/wiki/Technique/T1059
  - https://www.microsoft.com/en-us/wdsi/threats/macro-malware
  - https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2026-01-20

Description:
Detect and investigate VoidLink, an advanced cloud-native Linux malware framework discovered by Check Point Research in December 2025. VoidLink is a sophisticated, modular C2 framework written in Zig that targets cloud and containerized infrastructure with 30+ plugins, multiple rootkit capabilities (LD_PRELOAD, LKM, eBPF), and adaptive evasion mechanisms. The framework demonstrates commercial-grade development with Chinese-affiliated origins and is designed for long-term persistence, credential theft, and data exfiltration in AWS, GCP, Azure, Alibaba, and Tencent cloud environments. Monitor for cloud metadata service abuse, container escape attempts, systemd/cron persistence, LD_PRELOAD hijacking, kernel module loading, SSH lateral movement, and Linux-specific defense evasion techniques including log tampering and rootkit deployment. VoidLink's plugin-based architecture and cloud-first tradecraft make it particularly dangerous in modern containerized and Kubernetes environments.

References:
  - https://research.checkpoint.com/2026/voidlink-the-cloud-native-malware-framework/
  - https://attack.mitre.org/techniques/T1574/006/
  - https://attack.mitre.org/techniques/T1053/006/
  - https://attack.mitre.org/techniques/T1611/
  - https://attack.mitre.org/techniques/T1552/005/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2023-10-04

Description:
On October 4, 2023, Atlassian disclosed a critical privilege escalation vulnerability, CVE-2023-22515, affecting on-premises instances of Confluence Server and Confluence Data Center. This flaw might allow external attackers to exploit accessible Confluence instances, creating unauthorized Confluence administrator accounts. Indicators suggest the vulnerability is remotely exploitable. The affected versions range from 8.0.0 to 8.5.1, but versions prior to 8.0.0 and Atlassian Cloud sites are unaffected. Atlassian advises customers to update to a fixed version or implement mitigation strategies. Indicators of compromise (IoCs) and mitigation steps, such as blocking access to /setup/* endpoints, are provided.

References:
  - https://confluence.atlassian.com/security/cve-2023-22515-privilege-escalation-vulnerability-in-confluence-data-center-and-server[PII_REDACTED].html
  - https://www.rapid7.com/blog/post/2023/10/04/etr-cve-2023-22515-zero-day-privilege-escalation-in-confluence-server-and-data-center/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, splunk
Date: 2022-11-02

Description:
OpenSSL recently disclosed two vulnerabilities CVE-2022-3602 and CVE-2022-3786. CVE-2022-3602 is a X.509 Email Address 4-byte Buffer Overflow where puny code is utilized. This only affects OpenSSL 3.0.0 - 3.0.6.

References:
  - https://www.openssl.org/blog/blog/2022/11/01/email-address-overflows/
  - https://github.com/advisories/GHSA-h8jm-2x53-xhp5
  - https://community.emergingthreats.net/t/out-of-band-ruleset-update-summary-2022-11-01/117
  - https://github.com/corelight/CVE-2022-3602/tree/master/scripts
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2021-01-29

Description:
Monitor and detect techniques used by attackers who leverage the regsvr32.exe process to execute malicious code.

References:
  - https://attack.mitre.org/techniques/T1218/010/
  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.010/T1218.010.md
  - https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Raven Tait
Date: 2025-06-02

Description:
Fortify your insider threat monitoring with searches that monitor for and help you investigate possible remote employment fraud.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Rico Valdez, Splunk
Date: 2017-09-15

Description:
Monitor your enterprise to ensure that your endpoints are being patched and updated. Adversaries notoriously exploit known vulnerabilities that could be mitigated by applying routine security patches.

References:
  - https://learn.cisecurity.org/20-controls-download
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2023-04-06

Description:
Leverage searches that allow you to detect and investigate unusual activities that might relate to the data destruction, including deleting files, overwriting files, wiping disk and unrecoverable file encryption. This analytic story may cover several known activities related to malware implants used in geo-political war to wipe disks or files to interrupt the network-wide operation of a targeted organization. Analytics can detect the behavior of "DoubleZero Destructor", "CaddyWiper", "AcidRain", "AwfulShred", "Hermetic Wiper", "Swift Slicer", "Whisper Gate" and many more.

References:
  - https://attack.mitre.org/techniques/T1485/
  - https://researchcenter.paloaltonetworks.com/2018/09/unit42-xbash-combines-botnet-ransomware-coinmining-worm-targets-linux-windows/
  - https://www.picussecurity.com/blog/a-brief-history-and-further-technical-analysis-of-sodinokibi-ransomware
  - https://www.splunk.com/en_us/blog/security/threat-advisory-strt-ta02-destructive-software.html
  - https://www.splunk.com/en_us/blog/security/detecting-hermeticwiper.html
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2021-01-21

Description:
Monitor and detect techniques used by attackers who leverage the msbuild.exe process to execute malicious code.

References:
  - https://attack.mitre.org/techniques/T1127/001/
  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1127.001/T1127.001.md
  - https://github.com/infosecn1nja/MaliciousMacroMSBuild
  - https://github.com/xorrior/RandomPS-Scripts/blob/master/Invoke-ExecuteMSBuild.ps1
  - https://lolbas-project.github.io/lolbas/Binaries/Msbuild/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2022-03-17

Description:
Windows services are often used by attackers for persistence, privilege escalation, lateral movement, defense evasion, collection of data, a tool for recon, credential dumping and payload impact. This Analytic Story helps you monitor your environment for indications that Windows registry are being modified or created in a suspicious manner.

References:
  - https://attack.mitre.org/techniques/T1112/
  - https://redcanary.com/blog/windows-registry-attacks-threat-detection/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2023-09-07

Description:
NjRat is a notorious remote access trojan (RAT) predominantly wielded by malicious operators to infiltrate and wield remote control over compromised systems. This analytical story harnesses targeted search methodologies to uncover and investigate activities that could be indicative of NjRAT's presence. These activities include tracking file write operations for dropped files, scrutinizing registry modifications aimed at establishing persistence mechanisms, monitoring suspicious processes, self-deletion behaviors, browser credential parsing, firewall configuration alterations, spread itself via removable drive and an array of other potentially malicious actions.

References:
  - https://www.checkpoint.com/cyber-hub/threat-prevention/what-is-malware/what-is-njrat-malware/#:~:text=NJRat%20%E2%80%94%20also%20known%20as%20Bladabindi,malware%20variant%20in%20March%202023.
  - https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2025-01-27

Description:
Leverage searches that allow you to detect and investigate unusual activities that might relate to Backdoor.PingPong malware, a legacy threat that provides unauthorized remote access to compromised systems. Look for signs such as unexpected pings or ICMP traffic patterns that deviate from normal behavior. Investigate unauthorized processes or network connections, particularly those attempting to establish external communication. Combining threat intelligence with behavioral analytics helps identify this backdoor’s attempts to exploit vulnerabilities. Early detection and response are critical to mitigating the risk of this malware.

References:
  - https://www.crowdstrike.com/en-us/blog/an-analysis-of-lightbasin-telecommunications-attacks/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Rod Soto, Splunk
Date: 2020-09-01

Description:
Track when a user assumes an IAM role in another GCP account to obtain cross-account access to services and resources in that account. Accessing new roles could be an indication of malicious activity.

References:
  - https://cloud.google.com/iam/docs/understanding-service-accounts
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2025-11-14

Description:
Detection analytics for the NetSupport Remote Manager Tool primarily focus on identifying its misuse, as it's a legitimate tool often leveraged by adversaries. Endpoint detection involves flagging the client32.exe executable running from unusual directories like Downloads or ProgramData instead of its standard Program Files location. Suspicious activity also encompasses renamed binaries with the internal name "client32" communicating with netsupportsoftware.com, or unauthenticated remote control sessions. Furthermore, monitoring for PowerShell execution associated with NetSupport Manager can reveal malicious deployment. These analytics help distinguish legitimate remote support from potential unauthorized access.

References:
  - https://www.linkedin.com/posts/mauricefielenbach_cybersecurity-incidentresponse-dfir-activity[PII_REDACTED]448418304-g0gZ?utm_source=share&utm_medium=member_desktop&rcm=ACoAAAuFTjIB5weY_kcyu4qp3kHbI4v49tO0zEk
  - https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/
  - https://www.esentire.com/blog/evalusion-campaign-delivers-amatera-stealer-and-netsupport-rat
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Splunk Threat Research Team
Date: 2021-07-01

Description:
The following analytic story identifies behaviors related PrintNightmare, or CVE-2021-34527 previously known as (CVE-2021-1675), to gain privilege escalation on the vulnerable machine.

References:
  - https://github.com/cube0x0/CVE-2021-1675/
  - https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/
  - https://blog.truesec.com/2021/06/30/exploitable-critical-rce-vulnerability-allows-regular-users-to-fully-compromise-active-directory-printnightmare-cve-2021-1675/
  - https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Raven Tait, Splunk
Date: 2025-08-05

Description:
Medusa is a powerful, stealthy, versatile, and, modular rootkit designed to give attackers complete control over Linux systems. Medusa is compiled and ready to be executed as a small ELF executable file, which no means extra building or configuration requirements! Medusa is larger than a few hundred kilobytes in size. Once installed, the rootkit sets up a dynamic linker that modifies the way applications are loaded and executed on the system. At this point the Medusa hooks a plethora of API system calls, library functions and signal handlers to achieve imbreakable and uninterceptable persistence.

References:
  - https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2023-08-25

Description:
Microsoft has identified a nation-state activity group, Flax Typhoon, based in China, targeting Taiwanese organizations for espionage. The group maintains long-term access to networks with minimal use of malware, relying on built-in OS tools and benign software. The group's activities are primarily focused on Taiwan, but the techniques used could be easily reused in other operations outside the region. Microsoft has not observed Flax Typhoon using this access to conduct additional actions.

References:
  - https://www.microsoft.com/en-us/security/blog/2023/08/24/flax-typhoon-using-legitimate-software-to-quietly-access-taiwanese-organizations/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2026-03-03

Description:
BlankGrabber is a Windows-based information-stealing malware typically distributed through phishing emails, malicious downloads, cracked software, and fake game cheats.
Once executed, it harvests sensitive data such as saved browser passwords, cookies, autofill data, cryptocurrency wallet information, Discord tokens, and system details.
Stolen data is commonly exfiltrated to attacker-controlled servers via webhooks or encrypted channels. BlankGrabber often includes basic anti-analysis and obfuscation techniques to evade detection.
It poses significant risks to individuals and organizations by enabling account takeover, financial theft, and broader network compromise.


References:
  - https://malpedia.caad.fkie.fraunhofer.de/details/py.blankgrabber
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2025-02-03

Description:
Leverage searches for suspicious behaviors associated with Black Basta ransomware, focusing on key indicators such as process execution, registry modifications, and network activity. Monitor for unusual file encryption patterns, particularly involving cmd.exe, powershell.exe, or wmic.exe executing with arguments linked to volume shadow copy deletion (vssadmin delete shadows). Look for registry changes disabling security features or altering startup configurations. Track high-volume file modifications in rapid succession, indicative of ransomware encryption. Additionally, unauthorized remote service executions. Cross-reference endpoint logs, EDR alerts, and SIEM detections to correlate malicious activity. Behavioral analytics and heuristic-based detections can enhance visibility into evolving tactics. Implement robust monitoring and response mechanisms to mitigate Black Basta’s impact effectively.

References:
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-131a