deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Rod Soto, Splunk
Date: 2024-11-14

Description:
This search provides information on Kubernetes service accounts,accessing pods by IP address, verb and decision
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Michael Haag, Splunk
Date: 2025-12-04

Description:
The following analytic detects the use of default or publicly known named pipes associated with Cobalt Strike. It leverages Sysmon EventID 17 and 18 to identify specific named pipes commonly used by Cobalt Strike's Artifact Kit and Malleable C2 Profiles. This activity is significant because Cobalt Strike is a popular tool for adversaries to conduct post-exploitation tasks, and identifying its named pipes can reveal potential malicious activity. If confirmed malicious, this could indicate an active Cobalt Strike beacon, leading to unauthorized access, data exfiltration, or further lateral movement within the network.

References:
  - https://attack.mitre.org/techniques/T1218/009/
  - https://docs.microsoft.com/en-us/windows/win32/ipc/named-pipes
  - https://hstechdocs.helpsystems.com/manuals/cobaltstrike/current/userguide/index.htm#cshid=1040
  - https://www.cobaltstrike.com/blog/learn-pipe-fitting-for-all-of-your-offense-projects/
  - https://gist.github.com/MHaggis/6c600e524045a6d49c35291a21e10752
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Patrick Bareiss, Splunk
Date: 2024-11-14

Description:
This search detects loading of unsigned images by LSASS. Deprecated because too noisy.

References:
  - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Bhavin Patel, Splunk
Date: 2024-11-14

Description:
This search looks for processes launching netsh.exe to execute various commands via the netsh command-line utility. Netsh.exe is a command-line scripting utility that allows you to, either locally or remotely, display or modify the network configuration of a computer that is currently running. Netsh can be used as a persistence proxy technique to execute a helper .dll when netsh.exe is executed. In this search, we are looking for processes spawned by netsh.exe that are executing commands via the command line. Deprecated because we have another detection of the same type.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Patrick Bareiss, Splunk
Date: 2025-02-10

Description:
This search has been deprecated and updated with Risk Rule for Dev Sec Ops by Repository detection. The following analytic detects by correlating repository and risk score to identify patterns and trends in the data based on the level of risk associated. The analytic adds any null values and calculates the sum of the risk scores for each detection. Then, the analytic captures the source and user information for each detection and sorts the results in ascending order based on the risk score. Finally, the analytic filters the detections with a risk score below 80 and focuses only on high-risk detections.This detection is important because it provides valuable insights into the distribution of high-risk activities across different repositories. It also identifies the most vulnerable repositories that are frequently targeted by potential threats. Additionally, it proactively detects and responds to potential threats, thereby minimizing the impact of attacks and safeguarding critical assets. Finally, it provides a comprehensive view of the risk landscape and helps to make informed decisions to protect the organization's data and infrastructure. False positives might occur so it is important to identify the impact of the attack and prioritize response and mitigation efforts.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Rico Valdez, Splunk
Date: 2024-11-14

Description:
This search looks for processes launched from files with at least five spaces in the name before the extension. This is typically done to obfuscate the file extension by pushing it outside of the default view.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Michael Haag, Splunk
Date: 2025-10-06

Description:
The following analytic detects the execution of rundll32.exe loading advpack.dll or ieadvpack.dll via the LaunchINFSection function. This method is identified using Endpoint Detection and Response (EDR) telemetry, focusing on command-line executions and process details. This activity is significant as it indicates a potential application control bypass, allowing script code execution from a file. If confirmed malicious, an attacker could execute arbitrary code, potentially leading to privilege escalation, persistence, or further network compromise. Investigate script content, network connections, and any spawned child processes for further context.

References:
  - https://attack.mitre.org/techniques/T1218/011/
  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.011/T1218.011.md
  - https://lolbas-project.github.io/lolbas/Binaries/Rundll32/
  - https://lolbas-project.github.io/lolbas/Libraries/Advpack/
  - https://bohops.com/2018/02/26/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Bhavin Patel, Splunk
Date: 2025-02-10

Description:
The following analytic has been deprecated. The following analytic detects the creation of local administrator accounts using the net.exe command. It leverages Endpoint Detection and Response (EDR) data to identify processes named net.exe or net1.exe with the "/add" parameter and keywords related to administrator accounts. This activity is significant as it may indicate an attacker attempting to gain persistent access or escalate privileges. If confirmed malicious, this could lead to unauthorized access, data theft, or further system compromise. Review the process details, user context, and related artifacts to determine the legitimacy of the activity.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Bhavin Patel, Splunk
Date: 2024-11-14

Description:
This detection looks for emails that are suspicious because of their sender, domain rareness, or behavior differences. This is an anomaly generated by Splunk User Behavior Analytics (UBA).
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Jose Hernandez, Splunk
Date: 2024-11-14

Description:
The search takes the DNS records and their answers results of the discovered_dns_records lookup and finds if any records have changed by searching DNS response from the Network_Resolution datamodel across the last day.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Rod Soto, Splunk
Date: 2024-11-14

Description:
This search provides detection of high risk permissions by resource and accounts. These are permissions that can allow attackers with compromised accounts to move laterally and escalate privileges.

References:
  - https://github.com/dxa4481/gcploit
  - https://www.youtube.com/watch?v=Ml09R38jpok
  - https://cloud.google.com/iam/docs/permissions-reference
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Bhavin Patel, Splunk
Date: 2024-11-14

Description:
This search looks for successful AWS CloudTrail activity by user accounts that are not listed in the identity table or `aws_service_accounts.csv`. It returns event names and count, as well as the first and last time a specific user or service is detected, grouped by users. Deprecated because managing this list can be quite hard.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Jim Apger, Splunk
Date: 2024-11-14

Description:
This search is used to examine web sessions to identify those where the clicks are occurring too quickly for a human or are occurring with a near-perfect cadence (high periodicity or low standard deviation), resembling a script driven session.

References:
  - https://en.wikipedia.org/wiki/Session_ID
  - https://en.wikipedia.org/wiki/Session_(computer_science)
  - https://en.wikipedia.org/wiki/HTTP_cookie
  - https://splunkbase.splunk.com/app/1809/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: David Dorsey, Splunk
Date: 2026-03-10

Description:
The following analytic detects a spike in the number of API calls made to cloud security groups by a user. It leverages data from the Change data model, focusing on successful firewall-related changes. This activity is significant because an abnormal increase in security group API calls can indicate potential malicious activity, such as unauthorized access or configuration changes. If confirmed malicious, this could allow an attacker to manipulate security group settings, potentially exposing sensitive resources or disrupting network security controls.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Patrick Bareiss, Splunk
Date: 2024-11-14

Description:
This detection rule monitors for the creation of AWS Identity and Access Management (IAM) access keys. An IAM access key consists of an access key ID and secret access key, which are used to sign programmatic requests to AWS services. While IAM access keys can be legitimately used by developers and administrators for API access, their creation can also be indicative of malicious activity. Attackers who have gained unauthorized access to an AWS environment might create access keys as a means to establish persistence or to exfiltrate data through the APIs. Moreover, because access keys can be used to authenticate with AWS services without the need for further interaction, they can be particularly appealing for bad actors looking to operate under the radar. Consequently, it's important to vigilantly monitor and scrutinize access key creation events, especially if they are associated with unusual activity or are created by users who don't typically perform these actions. This hunting query identifies when a potentially compromised user creates a IAM access key for another user who may have higher privilleges, which can be a sign for privilege escalation. Hunting queries are designed to be executed manual during threat hunting.

References:
  - https://bishopfox.com/blog/privilege-escalation-in-aws
  - https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation-part-2/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: David Dorsey, Splunk
Date: 2025-01-16

Description:
This search looks for EC2 instances being created with previously unseen instance types.  This search is deprecated and have been translated to use the latest Change Datamodel.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Bhavin Patel, Splunk
Date: 2024-11-14

Description:
This search looks for AWS CloudTrail events where an instance is started in a particular region in the last one hour and then compares it to a lookup file of previously seen regions where an instance was started
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: David Dorsey, Splunk
Date: 2024-11-14

Description:
This search looks for AWS provisioning activities from previously unseen cities.  Provisioning activities are defined broadly as any event that begins with "Run" or "Create." This search is deprecated and have been translated to use the latest Change Datamodel.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Rico Valdez, Splunk
Date: 2025-02-10

Description:
The following analytic has been deprecated. The following analytic detects attempts to stop security-related services on an endpoint, which may indicate malicious activity. It leverages data from Endpoint Detection and Response (EDR) agents, specifically searching for processes involving the "sc.exe" command with the "stop" parameter. This activity is significant because disabling security services can undermine the organization's security posture, potentially leading to unauthorized access, data exfiltration, or further attacks like malware installation or privilege escalation. If confirmed malicious, this behavior could compromise the endpoint and the entire network, necessitating immediate investigation and response.

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-14---disable-arbitrary-security-windows-service
  - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Teoderick Contreras, Splunk
Date: 2025-02-10

Description:
The following analytic has been deprecated. The following analytic detects an Office document creating a scheduled task, either through a macro VBA API or by loading `taskschd.dll`. This detection leverages Sysmon EventCode 7 to identify when Office applications load the `taskschd.dll` file. This activity is significant as it is a common technique used by malicious macro malware to establish persistence or initiate beaconing. If confirmed malicious, this could allow an attacker to maintain persistence, execute arbitrary commands, or schedule future malicious activities, posing a significant threat to the environment.

References:
  - https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/
  - https://redcanary.com/threat-detection-report/techniques/scheduled-task-job/
  - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trojanized-onenote-document-leads-to-formbook-malware/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Michael Haag, Rico Valdez, Splunk
Date: 2025-02-10

Description:
**DEPRECATION NOTE** - This search has been deprecated and replaced with this detection `Okta Unauthorized Access to Application - DM`.  The following anomaly identifies failed Okta SSO events utilizing the legacy Okta event "unauth app access attempt".

References:
  - https://developer.okta.com/docs/reference/api/event-types/?q=app.generic.unauth_app_access_attempt
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Bhavin Patel, Splunk
Date: 2024-11-14

Description:
This search detects new API calls that have either never been seen before or that have not been seen in the previous hour, where the identity type is `AssumedRole`.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Michael Haag, Splunk
Date: 2024-12-10

Description:
NOTE - This search is deprecated in favor of `Windows Service Execution RemCom` as the latter is a more accurate name for the detection. The following analytic identifies the execution of RemCom.exe, an open-source alternative to PsExec, used for lateral movement and remote command execution. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, original file names, and command-line arguments. This activity is significant as it indicates potential lateral movement within the network. If confirmed malicious, this could allow an attacker to execute commands remotely, potentially leading to further compromise and control over additional systems within the network.

References:
  - https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/
  - https://github.com/kavika13/RemCom
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Michael Haag, Splunk
Date: 2025-06-26

Description:
The following analytic identifies the use of Windows InstallUtil.exe making a remote network connection using the `/u` (uninstall) switch. This detection leverages Endpoint Detection and Response (EDR) telemetry, focusing on process and network activity data. This behavior is significant as it may indicate an attempt to download and execute code while bypassing application control mechanisms. If confirmed malicious, this activity could allow an attacker to execute arbitrary code, potentially leading to system compromise, data exfiltration, or further lateral movement within the network.

References:
  - https://evi1cg.me/archives/AppLocker_Bypass_Techniques.html#menu_index_12
  - https://github.com/api0cradle/UltimateAppLockerByPassList/blob/master/md/Installutil.exe.md
  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Teoderick Contreras, Splunk
Date: 2025-10-27

Description:
This detection monitors the creation or modification of the Default.rdp file, typically found in the user's Documents folder. This file is automatically generated or updated by the Remote Desktop Connection client (mstsc.exe) when a user initiates an RDP session. It stores connection settings such as the last-used hostname, screen size, and other preferences. The presence or update of this file strongly suggests that an RDP session has been launched from the system. Since this file is commonly overlooked, it can serve as a valuable artifact in identifying remote access activity, including potential lateral movement or attacker-controlled sessions.

References:
  - https://medium.com/@bonguides25/how-to-clear-rdp-connections-history-in-windows-cf0ffb67f344
  - https://thelocalh0st.github.io/posts/rdp/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Teoderick Contreras, Splunk
Date: 2025-02-10

Description:
This search has been deprecated in favour of -  Windows Suspicious Process File Path. The following analytic identifies processes running from file  paths not typically associated with legitimate software. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on specific process paths within the Endpoint data model. This activity is significant because adversaries often use unconventional file paths to execute malicious code without requiring administrative privileges. If confirmed malicious, this behavior could indicate an attempt to bypass security controls, leading to unauthorized software execution, potential system compromise, and further malicious activities within the environment.

References:
  - https://www.trendmicro.com/vinfo/hk/threat-encyclopedia/malware/trojan.ps1.powtran.a/
  - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
  - https://twitter.com/pr0xylife/status/[PII_REDACTED]58104576
  - https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat
  - https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Rod Soto, Splunk
Date: 2024-11-14

Description:
This search provides detection of accounts with high risk roles by projects. Compromised accounts with high risk roles can move laterally or even scalate privileges at different projects depending on organization schema.

References:
  - https://github.com/dxa4481/gcploit
  - https://www.youtube.com/watch?v=Ml09R38jpok
  - https://cloud.google.com/iam/docs/understanding-roles
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Abhinav Mishra, Kumar Sharad and Namratha Sreekanta, Splunk
Date: 2026-03-10

Description:
The following analytic identifies suspicious DNS TXT records using a pre-trained deep learning model. It leverages DNS response data from the Network Resolution data model, categorizing TXT records into known types via regular expressions. Records that do not match known patterns are flagged as suspicious. This activity is significant as DNS TXT records can be used for data exfiltration or command-and-control communication. If confirmed malicious, attackers could use these records to covertly transfer data or receive instructions, posing a severe threat to network security.

References:
  - https://attack.mitre.org/techniques/T1071/004/
  - https://unit42.paloaltonetworks.com/dns-tunneling-how-dns-can-be-abused-by-malicious-actors/
  - https://en.wikipedia.org/wiki/TXT_record
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Teoderick Contreras, Splunk
Date: 2025-02-07

Description:
This analytic has been deprecated in favor of a new analytic - Windows Security And Backup Services Stop. The following analytic detects the suspicious termination of known services commonly targeted by ransomware before file encryption. It leverages Windows System Event Logs (EventCode 7036) to identify when critical services such as Volume Shadow Copy, backup, and antivirus services are stopped. This activity is significant because ransomware often disables these services to avoid errors and ensure successful file encryption. If confirmed malicious, this behavior could lead to widespread data encryption, rendering files inaccessible and potentially causing significant operational disruption and data loss.

References:
  - https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/
  - https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/
  - https://news.sophos.com/en-us/2020/04/24/lockbit-ransomware-borrows-tricks-to-keep-up-with-revil-and-maze/
  - https://blogs.vmware.com/security/2022/10/lockbit-3-0-also-known-as-lockbit-black.html
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Michael Haag, Splunk
Date: 2025-05-02

Description:
This analytic has been deprecated in favor of "Windows CertUtil Download". The following analytic detects the use of certutil.exe to download files using the `-urlcache` and `-f` arguments. It leverages Endpoint Detection and Response (EDR) data, focusing on command-line executions that include these specific arguments. This activity is significant because certutil.exe is typically used for certificate services, and its use to download files from remote locations is uncommon and potentially malicious. If confirmed, this behavior could indicate an attempt to download and execute malicious payloads, leading to potential system compromise and unauthorized data access.

References:
  - https://attack.mitre.org/techniques/T1105/
  - https://www.avira.com/en/blog/certutil-abused-by-attackers-to-spread-threats
  - https://web.archive.org/web/[PII_REDACTED]0637/https://www.fireeye.com/blog/threat-research/2019/10/certutil-qualms-they-came-to-drop-fombs.html
  - https://lolbas-project.github.io/lolbas/Binaries/Certutil/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Michael Haag, Splunk
Date: 2025-02-10

Description:
The following analytic has been deprecated in favour of a more generic approach. The following analytic identifies instances where Microsoft Excel spawns Windows Script Host processes (`cscript.exe` or `wscript.exe`). This behavior is detected using Endpoint Detection and Response (EDR) telemetry, focusing on process creation events where the parent process is `excel.exe`. This activity is significant because it is uncommon and often associated with malicious actions, such as spearphishing attacks. If confirmed malicious, this could allow an attacker to execute scripts, potentially leading to code execution, data exfiltration, or further system compromise. Immediate investigation and mitigation are recommended.

References:
  - https://app.any.run/tasks/8ecfbc29-03d0-421c-a5bf-3905d29192a2/
  - https://attack.mitre.org/techniques/T1566/001/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Rico Valdez, Splunk
Date: 2024-11-14

Description:
The search looks for modifications to the hosts file on all Windows endpoints across your environment.