deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2023-06-16

Description:
This analytic story contains searches that aims to detect activities related to Amadey, a type of malware that primarily operates as a banking Trojan. It is designed to steal sensitive information such as login credentials, credit card details, and other financial data from infected systems. The malware typically targets Windows-based computers.

References:
  - https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey
  - https://darktrace.com/blog/amadey-info-stealer-exploiting-n-day-vulnerabilities
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Bhavin Patel, Splunk
Date: 2018-09-06

Description:
Detect and investigate hosts in your environment that may be communicating with dynamic domain providers. Attackers may leverage these services to help them avoid firewall blocks and deny lists.

References:
  - https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html
  - https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/
  - http://www.noip.com/blog/2014/07/11/dynamic-dns-can-use-2/
  - https://www.splunk.com/blog/2015/08/04/detecting-dynamic-dns-domains-in-splunk.html
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2021-09-14

Description:
Leverage searches that allow you to detect and investigate unusual activities that might relate to the FIN7 JS Implant and JSSLoader, including looking for Image Loading of ldap and wmi modules, associated with its payload, data collection and script execution.

References:
  - https://en.wikipedia.org/wiki/FIN7
  - https://threatpost.com/fin7-windows-11-release/169206/
  - https://www.proofpoint.com/us/blog/threat-insight/jssloader-recoded-and-reloaded
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Rico Valdez, Splunk
Date: 2024-09-24

Description:
Monitor for and investigate activities--such as suspicious writes to the Windows Recycling Bin or email servers sending high amounts of traffic to specific hosts, for example--that may indicate that an adversary is harvesting and exfiltrating sensitive data.

References:
  - https://attack.mitre.org/wiki/Collection
  - https://attack.mitre.org/wiki/Technique/T1074
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2024-09-11

Description:
This analytic story contains detections that allow security analysts to detect and investigate unusual activities that might be related to ValleyRAT malware. ValleyRAT is a remote access trojan (RAT) known for targeting specific organizations and individuals to gain unauthorized access to systems. It enables attackers to execute commands, steal sensitive data, and manipulate files. This malware often uses phishing emails or malicious attachments to infect systems. Detecting ValleyRAT early is crucial to preventing data breaches and further exploitation. Analysts can use behavioral analysis and signature-based detection to mitigate its impact.

References:
  - https://www.proofpoint.com/us/blog/threat-insight/chinese-malware-appears-earnest-across-cybercrime-threat-landscape
  - https://www.fortinet.com/blog/threat-research/valleyrat-campaign-targeting-chinese-speakers
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2023-08-08

Description:
Ivanti, a leading technology company, has disclosed two critical zero-day vulnerabilities in its Endpoint Manager Mobile (EPMM) product, CVE-2023-35078 and CVE-2023-35081. A recent update concerning CVE-2023-35082, closely related to CVE-2023-35078, reveals its impact on more versions of Ivanti's software than initially believed. The former allows unauthenticated attackers to obtain sensitive data, modify servers, and access the API, potentially leading to data breaches or malicious system modifications. Meanwhile, CVE-2023-35081 lets authenticated administrators remotely write arbitrary files to the server. Both vulnerabilities have been exploited in targeted attacks against government ministries and could be used in conjunction. With the presence of PoC code for CVE-2023-35078, the risk of broader exploitation has increased. While initially leveraged in limited attacks, the exploitation is expected to rise, possibly involving state-sponsored actors. Organizations are urged to apply immediate patches and conduct regular system assessments to ensure security.

References:
  - https://www.securityweek.com/second-ivanti-epmm-zero-day-vulnerability-exploited-in-targeted-attacks/
  - https://www.cisa.gov/news-events/alerts/2023/07/28/ivanti-releases-security-updates-epmm-address-cve-2023-35081
  - https://nvd.nist.gov/vuln/detail/CVE-2023-35078
  - https://forums.ivanti.com/s/article/CVE-2023-35078-Remote-unauthenticated-API-access-vulnerability?language=en_US
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2026-03-31

Description:
Leverage searches that help you detect and investigate post-compromise activity that may
follow installation of compromised axios npm releases (notably axios@1.14.1 and axios@0.30.4) and the phantom dependency plain-crypto-js@4.2.1 from the March 2026 supply chain incident documented by Huntress, Socket, Step Security, and others.

The backdoored packages used a malicious postinstall script to drop a cross-platform remote access trojan with Windows, macOS, and Linux payloads, process staging, and command-and-control beaconing. Use these analytics alongside dependency audits and EDR data to scope impact, prioritize containment, and support recovery on hosts that resolved the malicious versions during the exposure window.

References:
  - https://www.huntress.com/blog/supply-chain-compromise-axios-npm-package
  - https://thehackernews.com/2026/03/axios-supply-chain-attack-pushes-cross.html
  - https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan
  - https://socket.dev/blog/axios-npm-package-compromised
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Raven Tait, Splunk
Date: 2025-11-13

Description:
Detects Kerberos coercion attacks via DNS manipulation. Identifies DNS record modifications where the Distinguished Name contains a base64-encoded CREDENTIAL_TARGET_INFORMATION structure.

References:
  - https://web.archive.org/web/[PII_REDACTED]2747/https://www.synacktiv.com/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025
  - https://www.synacktiv.com/publications/relaying-kerberos-over-smb-using-krbrelayx
  - https://www.guidepointsecurity.com/blog/the-birth-and-death-of-loopyticket/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2021-09-08

Description:
CVE-2021-40444 is a remote code execution vulnerability in MSHTML, recently used to delivery targeted spearphishing documents.

References:
  - https://blog.malwarebytes.com/exploits-and-vulnerabilities/2021/09/windows-mshtml-zero-day-actively-exploited-mitigations-required/
  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444
  - https://www.echotrail.io/insights/search/control.exe
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Mauricio Velazco, Splunk
Date: 2023-03-20

Description:
Monitor for activities and techniques associated with Privilege Escalation attacks within Active Directory environments.

References:
  - https://attack.mitre.org/tactics/TA0004/
  - https://adsecurity.org/?p=3658
  - https://adsecurity.org/?p=2362
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2023-11-27

Description:
This story contains detections for Windows Attack Surface Reduction (ASR) events. ASR is a feature of Windows Defender Exploit Guard that prevents actions and apps that are typically used by exploit-seeking malware to infect machines. ASR rules are applied to processes and applications. When a process or application attempts to perform an action that is blocked by an ASR rule, an event is generated. This story contains detections for ASR events that are generated when a process or application attempts to perform an action that is blocked by an ASR rule.

References:
  - https://asrgen.streamlit.app/
  - https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/attack-surface-reduction?view=o365-worldwide
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Teoderick Contreras, Mauricio Velazco, Splunk
Date: 2021-08-24

Description:
ProxyShell is a chain of exploits targeting on-premise Microsoft Exchange Server - CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207.

References:
  - https://y4y.space/2021/08/12/my-steps-of-reproducing-proxyshell/
  - https://www.zerodayinitiative.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell
  - https://www.youtube.com/watch?v=FC6iHw258RI
  - https://www.huntress.com/blog/rapid-response-microsoft-exchange-servers-still-vulnerable-to-proxyshell-exploit#what-should-you-do
  - https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-ProxyLogon-Is-Just-The-Tip-Of-The-Iceberg-A-New-Attack-Surface-On-Microsoft-Exchange-Server.pdf
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Steven Dick
Date: 2025-01-14

Description:
Fortify your remote access and unapproved software monitoring with searches that monitor for and help you investigate the use of unappoved or malicious remote monitoring and management softwares (RMM).

References:
  - https://attack.mitre.org/techniques/T1219/
  - https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/
  - https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: iDefense Cyber Espionage Team, iDefense
Date: 2020-01-22

Description:
Monitor your environment for suspicious behaviors that resemble the techniques employed by the MUDCARP threat group.

References:
  - https://www.infosecurity-magazine.com/news/scope-of-mudcarp-attacks-highlight-1/
  - http://blog.amossys.fr/badflick-is-not-so-bad.html
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Hart
Date: 2021-06-08

Description:
Meterpreter provides red teams, pen testers and threat actors interactive access to a compromised host to run commands, upload payloads, download files, and other actions.

References:
  - https://www.offensive-security.com/metasploit-unleashed/about-meterpreter/
  - https://doubleoctopus.com/security-wiki/threats-and-tools/meterpreter/
  - https://www.rapid7.com/products/metasploit/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Rod Soto, Michael Haag, Splunk
Date: 2022-03-02

Description:
This analytic story contains detections that allow security analysts to detect and investigate unusual activities that might relate to the destructive malware targeting Ukrainian organizations also known as "Hermetic Wiper". This analytic story looks for abuse of Regsvr32, executables written in administrative SMB Share, suspicious processes, disabling of memory crash dump and more.

References:
  - https://www.sentinelone.com/labs/hermetic-wiper-ukraine-under-attack/
  - https://www.cisa.gov/uscert/ncas/alerts/aa22-057a
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2025-10-14

Description:
Scattered Lapsus$ Hunters is a collaboration of three sophisticated threat actor groups (Scattered Spider, Lapsus$, and Shiny Hunters) known for devastating supply chain attacks, advanced social engineering, MFA bypass techniques, and credential theft. The group gained notoriety following their September 2025 attack on Jaguar Land Rover, causing three weeks of production shutdown and £50M+ weekly losses.

References:
  - https://www.wired.com/story/jlr-jaguar-land-rover-cyberattack-supply-chain-disaster/
  - https://wpsites.ucalgary.ca/jacobson-cpsc/2025/10/02/inside-the-jaguar-land-rover-cyberattack/
  - https://claroty.com/blog/5-security-takeaways-from-the-jaguar-land-rover-cyberattack
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2026-02-12

Description:
DynoWiper is a newly documented data-wiping malware identified by ESET researchers during a destructive cyber incident targeting an energy company in a critical infrastructure. Designed to overwrite files and force a system reboot, DynoWiper erases data across removable and fixed drives, rendering systems inoperable if unprotected. ESET attributes the malware to the Russia-aligned threat group Sandworm with medium confidence, noting shared tactics and coding patterns with previous destructive wiper families like ZOV. Endpoint defenses successfully blocked execution, highlighting the need for robust detection.

References:
  - https://www.welivesecurity.com/en/eset-research/dynowiper-update-technical-analysis-attribution/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Bhavin Patel, Splunk
Date: 2017-09-15

Description:
Leverage searches that detect cleartext network protocols that may leak credentials or should otherwise be encrypted.

References:
  - https://www.monkey.org/~dugsong/dsniff/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2024-01-22

Description:
The following analytic story covers use cases for detecting and investigating potential attacks against Confluence Data Center and Confluence Server.

References:
  - https://confluence.atlassian.com/security/cve-2023-22527-rce-remote-code-execution-vulnerability-in-confluence-data-center-and-confluence-server[PII_REDACTED].html
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2025-08-05

Description:
This analytic story addresses the increasing trend of adversaries leveraging MSIX installers to deliver malware. MSIX is Microsoft's latest Windows application package format, designed to improve upon MSI limitations. Since mid-2023, multiple threat actors have been observed abusing MSIX files to deliver various malware payloads, often through malvertising or SEO poisoning campaigns that masquerade as legitimate software installers.

References:
  - https://redcanary.com/blog/threat-intelligence/msix-installers/
  - https://redcanary.com/threat-detection-report/techniques/installer-packages/
  - https://learn.microsoft.com/en-us/windows/msix/package/unsigned-package
  - https://learn.microsoft.com/en-us/windows/msix/desktop/powershell-msix-cmdlets
  - https://learn.microsoft.com/en-us/powershell/module/appx/add-appxpackage
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2022-04-12

Description:
Leverage searches that allow you to detect and investigate unusual activities that might relate to the acidrain malware including deleting of files and etc. AcidRain is an ELF MIPS malware specifically designed to wipe modems and routers. The complete list of targeted devices is unknown at this time, but WatchGuard FireBox has specifically been listed as a target. This malware is capable of wiping and deleting non-standard linux files and overwriting storage device files that might related to router, ssd card and many more.

References:
  - https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Rod Soto, David Dorsey, Splunk
Date: 2020-10-27

Description:
Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware. These searches include cloud related objects that may be targeted by malicious actors via cloud providers own encryption features.

References:
  - https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/
  - https://github.com/d1vious/git-wild-hunt
  - https://www.youtube.com/watch?v=PgzNib37g0M
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2024-02-22

Description:
This analytic story provides a collection of analytics that detect potential exploitation of WordPress vulnerabilities. The analytics are focused on the detection of known vulnerabilities in WordPress plugins and themes.

References:
  - https://attack.mitre.org/techniques/T1190
  - https://github.com/Tornad0007/CVE-2024-25600-Bricks-Builder-plugin-for-WordPress/blob/main/exploit.py
  - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-25600
  - https://op-c.net/blog/cve-2024-25600-wordpresss-bricks-builder-rce-flaw-under-active-exploitation/
  - https://thehackernews.com/2024/02/wordpress-bricks-theme-under-active.html
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2025-02-07

Description:
SnappyBee is a stealthy malware variant designed to exfiltrate sensitive data while evading traditional security measures. It primarily spreads through phishing emails, malicious attachments, and drive-by downloads. Once executed, SnappyBee establishes persistence by modifying system registries and injecting malicious code into legitimate processes. It employs advanced obfuscation techniques to avoid detection, including polymorphic encryption and sandbox evasion. The malware actively monitors user activities, capturing credentials, keystrokes, and network traffic before transmitting the stolen data to a remote command-and-control (C2) server. This analytic story is designed to detect possible mitre attack tatics and technique related to SnappyBee malware.

References:
  - https://www.trendmicro.com/en_nl/research/24/k/earth-estries.html
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2026-03-10

Description:
MuddyWater is an Iranian-linked APT group (also tracked as MERCURY, Static Kitten) attributed to Iran's Ministry of Intelligence and Security. It has been active since at least 2017 and uses script-based malware (PowerShell, VBScript, JavaScript), malicious documents (PDF, Word, Excel), living-off-the-land binaries, and RATs such as SloughRAT. Campaigns employ obfuscation, anti-sandbox techniques, and have leveraged Log4j exploits against SysAid Server. Targets include government, military, and private sector organizations across the Middle East, Turkey, South Asia, and elsewhere. Detection focuses on document-based initial access, script execution patterns, and post-exploitation behavior consistent with Talos and industry reporting.


References:
  - https://blog.talosintelligence.com/talos-developing-situation-in-the-middle-east/
  - https://blog.talosintelligence.com/iranian-supergroup-muddywater
  - https://blog.talosintelligence.com/recent-muddywater-associated-blackwater
  - https://blog.talosintelligence.com/iranian-apt-muddywater-targets-turkey/
  - https://unit42.paloaltonetworks.com/unit42-muddying-the-water-targeted-attacks-in-the-middle-east/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2023-01-24

Description:
Leverage searches that allow you to detect and investigate unusual activities that might relate to the AsyncRAT malware including mshta application child process, bat loader execution, persistence and many more. AsyncRAT is an open source remote administration tool released last 2019. It's designed to remotely control computers via an encrypted connection, with view screen, keylogger, chat communication, persistence, defense evasion (e.g. Windows defender), DOS attack and many more.

References:
  - https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat
  - https://www.netskope.com/blog/asyncrat-using-fully-undetected-downloader
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2022-07-26

Description:
Leverage searches that allow you to detect and investigate unusual activities that might relate to the DcRat malware including ddos, spawning more process, botnet c2 communication, defense evasion and etc. The DcRat malware is known commercial backdoor that was first released in 2018. This tool was sold in underground forum and known to be one of the cheapest commercial RATs. DcRat is modular and bespoke plugin framework make it a very flexible option, helpful for a range of nefearious uses.

References:
  - https://www.mandiant.com/resources/analyzing-dark-crystal-rat-backdoor
  - https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2023-09-11

Description:
CERT-UA has unveiled a cyberattack on Ukraine's energy infrastructure, orchestrated via deceptive emails. These emails, once accessed, lead to a multi-stage cyber operation downloading and executing malicious payloads. Concurrently, Zscaler's "Steal-It" campaign detection revealed striking similarities, hinting at a shared origin - APT28 or Fancy Bear. This notorious group, linked to Russia's GRU, utilizes legitimate platforms like Mockbin, making detection challenging. Their operations underline the evolving cyber threat landscape and stress the importance of advanced defenses.

References:
  - https://cert.gov.ua/article/5702579
  - https://www.zscaler.com/blogs/security-research/steal-it-campaign
  - https://attack.mitre.org/groups/G0007/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Bhavin Patel, Splunk
Date: 2018-05-31

Description:
Monitor for activities and techniques associated with maintaining persistence on a Windows system--a sign that an adversary may have compromised your environment.

References:
  - http://www.fuzzysecurity.com/tutorials/19.html
  - https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html
  - http://resources.infosecinstitute.com/common-malware-persistence-mechanisms/
  - https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html
  - https://www.youtube.com/watch?v=dq2Hv7J9fvk
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Patrick Bareiss, Splunk
Date: 2021-08-18

Description:
This story is focused around detecting attacks on a DevSecOps lifeccycle which consists of the phases plan, code, build, test, release, deploy, operate and monitor.

References:
  - https://www.redhat.com/en/topics/devops/what-is-devsecops
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2023-01-16

Description:
Leverage searches that allow you to detect and investigate unusual activities that might relate to the LockBit ransomware, including looking for file writes (file encryption and ransomware notes), deleting services, terminating processes, registry key modification and more.

References:
  - https://blogs.vmware.com/security/2022/10/lockbit-3-0-also-known-as-lockbit-black.html
  - https://news.sophos.com/en-us/2020/04/24/lockbit-ransomware-borrows-tricks-to-keep-up-with-revil-and-maze/
  - https://www.cybereason.com/blog/threat-analysis-report-lockbit-2.0-all-paths-lead-to-ransom
  - https://www.trendmicro.com/en_us/research/22/g/lockbit-ransomware-group-augments-its-latest-variant--lockbit-3-.html