deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2026-04-15

Description:
The following analytic detects instances where a Chrome or Chromium-based browser is launched with the --no-sandbox flag, a known indicator of potentially malicious or suspicious behavior. While this flag is occasionally used during software development or testing, it is rarely seen in normal user activity. Threat actors often abuse this setting to disable Chrome's built-in security sandbox, making it easier to execute malicious code or escape browser isolation. This behavior is commonly observed in malware droppers or loaders that embed Chromium components for command and control, credential theft, or UI spoofing. Analysts should investigate such events, especially if they originate from unusual parent processes (e.g., powershell.exe, cmd.exe, or unknown binaries), or if accompanied by other indicators such as file drops, process injection, or outbound network activity. Filtering by command-line arguments and process ancestry can help reduce false positives and surface high-fidelity detections.


References:
  - https://unix.stackexchange.com/questions/68832/what-does-the-chromium-option-no-sandbox-mean
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Dean Luxton
Date: 2026-04-15

Description:
Detect when a user creates a new DACL in AD for their own AD object.

References:
  - https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2026-04-15

Description:
The following analytic detects a modification to the Windows registry setting "LongPathsEnabled," which allows file paths longer than 260 characters. This detection leverages data from the Endpoint.Registry datamodel, focusing on changes to the specific registry path and value. This activity is significant because adversaries, including malware like BlackByte, exploit this setting to bypass file path limitations, potentially aiding in evasion techniques. If confirmed malicious, this modification could facilitate the execution of long-path payloads, aiding in persistence and further system compromise.

References:
  - https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Mauricio Velazco, Splunk
Date: 2026-04-15

Description:
The following analytic detects the execution of `powershell.exe` with command-line arguments that utilize `Get-DomainComputer` to discover remote systems. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as `Get-DomainComputer` is part of PowerView, a tool often used by adversaries for domain enumeration and situational awareness. If confirmed malicious, this activity could allow attackers to map out the network, identify critical systems, and plan further attacks, potentially leading to unauthorized access and data exfiltration.

References:
  - https://attack.mitre.org/techniques/T1018/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2026-05-04

Description:
The following analytic detects modifications to the Windows registry that disable Windows Defender's infection reporting. It leverages data from the Endpoint.Registry datamodel, specifically monitoring changes to the "DontReportInfectionInformation" registry key. This activity is significant because it can prevent Windows Defender from reporting detailed threat information to Microsoft, potentially allowing malware to evade detection. If confirmed malicious, this action could enable attackers to bypass security measures, maintain persistence, and avoid detection, leading to prolonged unauthorized access and potential data breaches.

References:
  - https://x.com/malmoeb/status/[PII_REDACTED]89415386?s=20
  - https://github.com/undergroundwires/privacy.sexy
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2026-04-15

Description:
The following analytic detects suspicious raw access reads to the drive containing the Master Boot Record (MBR). It leverages Sysmon EventCode 9 to identify processes attempting to read or write to the MBR sector, excluding legitimate system processes. This activity is significant because adversaries often target the MBR to wipe, encrypt, or overwrite it as part of their impact payload. If confirmed malicious, this could lead to system instability, data loss, or a complete system compromise, severely impacting the organization's operations.

References:
  - https://www.splunk.com/en_us/blog/security/threat-advisory-strt-ta02-destructive-software.html
  - https://www.crowdstrike.com/blog/technical-analysis-of-whispergate-malware/
  - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2026-04-15

Description:
The following analytic detects the process of logging off a user through the use of the quser and logoff commands. By monitoring for these commands, the analytic identifies actions where a user session is forcibly terminated, which could be part of an administrative task or a potentially unauthorized access attempt. This detection helps identify potential misuse or malicious activity where a user’s access is revoked without proper authorization, providing insight into potential security incidents involving account management or session manipulation.

References:
  - https://devblogs.microsoft.com/scripting/automating-quser-through-powershell/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Nasreddine Bencherchali, Splunk
Date: 2026-04-15

Description:
The following analytic identifies the execution of wbadmin.exe with arguments indicative of restoring files from an existing backup.
WBAdmin is a legitimate Windows Backup utility used for creating, managing, and restoring backups. However, adversaries may abuse it to restore specific files (e.g., sensitive credentials, configuration files, or malware stagers) from prior backups to regain access or re-establish persistence after cleanup or encryption events.
Monitoring this behavior is important because restoring individual files from a system backup outside of approved recovery workflows may indicate an attacker attempting to retrieve deleted or encrypted data, recover previously dropped payloads, or access prior system states as part of post-compromise activity.
If confirmed malicious, this action could enable attackers to regain operational footholds, extract sensitive data, or restore tampered components, undermining remediation and containment efforts.


References:
  - https://lolbas-project.github.io/lolbas/Binaries/Wbadmin/
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-start-recovery
  - https://redmondmag.com/articles/2025/07/18/restoring-a-file-from-a-windows-image-backup.aspx
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Nasreddine Bencherchali, Splunk
Date: 2026-04-15

Description:
The following analytic detects the creation of scheduled tasks in Windows using schtasks.exe with the "XML" parameter.
This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions and process details.
This activity is significant as it is a common technique for establishing persistence or achieving privilege escalation, often used by malware like Trickbot and Winter-Vivern. While creating a scheduled task via XML may be legitimate, it can also be abused by attackers. If confirmed malicious, this could allow attackers to maintain access, execute additional payloads, and potentially lead to data theft or ransomware deployment.


References:
  - https://twitter.com/_CERT_UA/status/[PII_REDACTED]57091584
  - https://cert.gov.ua/article/3761104
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2026-04-15

Description:
The following analytic detects the creation of suspicious service files within the systemd directories on Linux platforms. It leverages logs containing file name, file path, and process GUID data from endpoints. This activity is significant for a SOC as it may indicate an adversary attempting to establish persistence on a compromised host. If confirmed malicious, this could lead to system compromise or data exfiltration, allowing attackers to maintain control over the system and execute further malicious activities.

References:
  - https://attack.mitre.org/techniques/T1053/006/
  - https://www.intezer.com/blog/research/kaiji-new-chinese-linux-malware-turning-to-golang/
  - https://redcanary.com/blog/attck-t1501-understanding-systemd-service-persistence/
  - https://github.com/microsoft/MSTIC-Sysmon/blob/main/linux/configs/attack-based/persistence/T1053.003_Cron_Activity.xml
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Nasreddine Bencherchali, Splunk, Zaki Zarkasih Al Mustafa
Date: 2026-04-15

Description:
The following analytic detects the presence of "api.telegram.org" in the CommandLine of a process. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs that include command-line details. This activity can be significant as the telegram API has been used as an exfiltration mechanism or even as a C2 channel. If confirmed malicious, this could allow an attacker or malware to exfiltrate data or receive additional C2 instruction, potentially leading to further compromise and persistence within the network.

References:
  - https://www.virustotal.com/gui/file/0b3ef5e04329cefb5bb4bf30b3edcb32d1ec6bbcb29d22695a079bfb5b56e8ac/behavior
  - https://www.virustotal.com/gui/file/72c59eeb15b5ec1d95e72e4b06a030bc058822bc10e5cb807e78a4624d329666/behavior
  - https://www.virustotal.com/gui/file/72c59eeb15b5ec1d95e72e4b06a030bc058822bc10e5cb807e78a4624d329666/content
  - https://www.virustotal.com/gui/file/1c4541bf70b6e251ef024ec4dde8dce400539c2368461c0d90e15a81b11ace44/content
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2026-04-15

Description:
The following analytic detects a process loading a version.dll file from a directory other than %windir%\system32 or %windir%\syswow64. This detection leverages Sysmon EventCode 7 to identify instances where an unsigned or improperly located version.dll is loaded. This activity is significant as it is a common technique used in ransomware and APT malware campaigns, including Brute Ratel C4, to execute malicious code via DLL side loading. If confirmed malicious, this could allow attackers to execute arbitrary code, maintain persistence, and potentially compromise the target host.

References:
  - https://www.mdsec.co.uk/2022/08/part-3-how-i-met-your-beacon-brute-ratel/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2026-04-15

Description:
The following analytic detects the use of the PowerShell cmdlet `export-pfxcertificate` on the command line, indicating an attempt to export a certificate from the local Windows Certificate Store. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs and command-line arguments. This activity is significant as it may indicate an attempt to exfiltrate authentication certificates, which can be used to impersonate users or decrypt sensitive data. If confirmed malicious, this could lead to unauthorized access and potential data breaches.

References:
  - https://dev.to/iamthecarisma/managing-windows-pfx-certificates-through-powershell-3pj
  - https://learn.microsoft.com/en-us/powershell/module/pki/export-pfxcertificate?view=windowsserver2022-ps
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk, Steven Dick
Date: 2026-05-04

Description:
The following analytic identifies modifications to the Windows registry that disable Task Manager. It leverages data from the Endpoint.Registry data model, specifically looking for changes to the registry path "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableTaskMgr" with a value of "0x00000001". This activity is significant as it is commonly associated with malware such as RATs, Trojans, and worms, which disable Task Manager to prevent users from terminating malicious processes. If confirmed malicious, this could allow attackers to maintain persistence and control over the infected system.

References:
  - https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry
  - https://blog.talosintelligence.com/2020/05/threat-roundup-0424-0501.html
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Bhavin Patel, Splunk
Date: 2026-04-15

Description:
The following analytic detects the execution of suspicious bash commands commonly used in scripts like AutoSUID, LinEnum, and LinPeas for system discovery on a Linux host. It leverages Endpoint Detection and Response (EDR) data, specifically looking for a high number of distinct commands executed within a short time frame. This activity is significant as it often precedes privilege escalation or other malicious actions. If confirmed malicious, an attacker could gain detailed system information, identify vulnerabilities, and potentially escalate privileges, posing a severe threat to the environment.

References:
  - https://attack.mitre.org/matrices/enterprise/linux/
  - https://attack.mitre.org/techniques/T1059/004/
  - https://github.com/IvanGlinkin/AutoSUID
  - https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS
  - https://github.com/rebootuser/LinEnum
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2026-04-15

Description:
The following analytic detects the creation of files in the /etc/profile.d directory on Linux systems. It leverages filesystem data to identify new files in this directory, which is often used by adversaries for persistence by executing scripts upon system boot. This activity is significant as it may indicate an attempt to maintain long-term access to the compromised host. If confirmed malicious, this could allow attackers to execute arbitrary code with elevated privileges each time the system boots, potentially leading to further compromise and data exfiltration.

References:
  - https://attack.mitre.org/techniques/T1546/004/
  - https://www.intezer.com/blog/research/kaiji-new-chinese-linux-malware-turning-to-golang/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Raven Tait, Splunk
Date: 2026-04-15

Description:
Detects the deletion or modification of logs on MacOS systems by identifying execution of the rm command with command-line arguments referencing system.log or audit-related paths.
Adversaries may remove or alter log files to cover their tracks and hinder detection and forensic analysis. This behavior commonly occurs during post-exploitation cleanup.

References:
  - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: experimental
Author: Michael Haag, Splunk
Date: 2026-03-10

Description:
The following analytic detects the use of the curl command contacting suspicious remote domains, such as s3.amazonaws.com, which is indicative of Command and Control (C2) activity or downloading further implants. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs and command-line arguments. This activity is significant as it may indicate the presence of MacOS adware or other malicious software attempting to establish persistence or exfiltrate data. If confirmed malicious, this could allow attackers to maintain control over the compromised system and deploy additional payloads.

References:
  - https://redcanary.com/blog/clipping-silver-sparrows-wings/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Raven Tait, Splunk
Date: 2026-04-13

Description:
Detects the modification of a Windows Filtering Platform Policy to block the communication of known EDR processes.
This can be used by attackers to impair the functionality of these tools and to hide their activities on the machine.

References:
  - https://unit42.paloaltonetworks.com/edr-bypass-extortion-attempt-thwarted/
  - https://github.com/wavestone-cdt/EDRSandblast?tab=readme-ov-file
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Mauricio Velazco, Michael Haag, Splunk
Date: 2026-04-15

Description:
The following analytic detects the spawning of `rundll32.exe` without command-line arguments by `spoolsv.exe`, which is unusual and potentially indicative of exploitation attempts like CVE-2021-34527 (PrintNightmare). This detection leverages Endpoint Detection and Response (EDR) telemetry, focusing on process creation events where `spoolsv.exe` is the parent process. This activity is significant as `spoolsv.exe` typically does not spawn other processes, and such behavior could indicate an active exploitation attempt. If confirmed malicious, this could allow an attacker to execute arbitrary code, escalate privileges, or maintain persistence on the compromised endpoint.

References:
  - https://www.truesec.com/hub/blog/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available
  - https://www.truesec.com/hub/blog/exploitable-critical-rce-vulnerability-allows-regular-users-to-fully-compromise-active-directory-printnightmare-cve-2021-1675
  - https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Mauricio Velazco, Dean Luxton, Splunk
Date: 2026-04-15

Description:
The following analytic detects modifications to the Access Control List (ACL) of the AdminSDHolder object in a Windows domain, specifically the addition of new rules. It leverages EventCode 5136 from the Security Event Log, focusing on changes to the nTSecurityDescriptor attribute. This activity is significant because the AdminSDHolder object secures privileged group members, and unauthorized changes can allow attackers to establish persistence and escalate privileges. If confirmed malicious, this could enable an attacker to control domain-level permissions, compromising the entire Active Directory environment.

References:
  - https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/appendix-c--protected-accounts-and-groups-in-active-directory
  - https://social.technet.microsoft.com/wiki/contents/articles/22331.adminsdholder-protected-groups-and-security-descriptor-propagator.aspx
  - https://adsecurity.org/?p=1906
  - https://pentestlab.blog/2022/01/04/domain-persistence-adminsdholder/
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5136
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Sittikorn S
Date: 2026-04-15

Description:
The following analytic detects the use of `bitsadmin.exe` with the `transfer` parameter to download a remote object. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and command-line telemetry. This activity is significant because `bitsadmin.exe` can be exploited to download and execute malicious files without immediate detection. If confirmed malicious, an attacker could use this technique to download and execute payloads, potentially leading to code execution, privilege escalation, or persistent access within the environment. Review parallel and child processes, especially `svchost.exe`, for associated artifacts.

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/8eb52117b748d378325f7719554a896e37bccec7/atomics/T1105/T1105.md#atomic-test-9---windows---bitsadmin-bits-download
  - https://github.com/redcanaryco/atomic-red-team/blob/bc705cb7aaa5f26f2d96585fac8e4c7052df0ff9/atomics/T1197/T1197.md
  - https://docs.microsoft.com/en-us/windows/win32/bits/bitsadmin-tool
  - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Mauricio Velazco, Lou Stella, Splunk
Date: 2026-04-09

Description:
The following analytic detects outbound network connections from Java processes to default ports used by LDAP and RMI protocols, which may indicate exploitation of the CVE-2021-44228-Log4j vulnerability.
This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and network traffic logs.
Monitoring this activity is crucial as it can signify an attacker's attempt to perform JNDI lookups and retrieve malicious payloads.
If confirmed malicious, this activity could lead to remote code execution and further compromise of the affected server.


References:
  - https://www.lunasec.io/docs/blog/log4j-zero-day/
  - https://www.govcert.admin.ch/blog/zero-day-exploit-targeting-popular-java-library-log4j/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2026-04-15

Description:
The following analytic detects instances of regsvcs.exe running without command line arguments. This behavior typically indicates process injection, where another process manipulates regsvcs.exe. The detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, IDs, and command-line executions. This activity is significant as it may signal an attempt to evade detection and execute malicious code. If confirmed malicious, the attacker could achieve code execution, potentially leading to privilege escalation, persistence, or access to sensitive information.

References:
  - https://attack.mitre.org/techniques/T1218/009/
  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.009/T1218.009.md
  - https://lolbas-project.github.io/lolbas/Binaries/Regsvcs/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2026-04-21

Description:
The following analytic identifies the creation of executables or scripts in suspicious file paths on Windows systems. It leverages the Endpoint.Filesystem dataset to detect files with specific extensions (e.g., .exe, .dll, .ps1) created in uncommon directories (e.g., \windows\fonts\, \users\public\). This activity can be significant as adversaries often use these paths to evade detection and maintain persistence. If confirmed malicious, this behavior could allow attackers to execute unauthorized code, escalate privileges, or persist within the environment, posing a significant security threat.

References:
  - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
  - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
  - https://twitter.com/pr0xylife/status/[PII_REDACTED]58104576
  - https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/