deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Rod Soto, Splunk
Date: 2024-12-09

Description:
Leverage searches that allow you to detect and investigate unusual activities that might be related to the  SVR cyber activity tactics and techniques. While SVR followed a similar playbook in each compromise, they also adjusted to each operating environment and not all presented steps or actions below were executed on every host.

References:
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Raven Tait, Splunk
Date: 2026-02-26

Description:
Monitor for and investigate activities that may be associated with a MacOS privilege-escalation attack, including unusual processes running on endpoints, schedule task, services, setuid, root execution and more.

References:
  - https://attack.mitre.org/tactics/TA0004/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2023-02-21

Description:
On Thursday, 16 February 2023, Fortinet released a PSIRT that details CVE-2022-39952, a critical vulnerability affecting its FortiNAC product (Horizon3.ai).

References:
  - https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/
  - https://viz.greynoise.io/tag/fortinac-rce-attempt?days=30
  - https://www.bleepingcomputer.com/news/security/fortinet-fixes-critical-rce-flaws-in-fortinac-and-fortiweb/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2024-02-12

Description:
SnakeKeylogger is a stealthy malware designed to secretly record keystrokes on infected devices. It operates covertly in the background, capturing sensitive information such as passwords and credit card details. This keylogging threat poses a significant risk to user privacy and security.

References:
  - https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger
  - https://www.checkpoint.com/cyber-hub/threat-prevention/what-is-malware/snake-keylogger-malware/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: David Dorsey, Splunk
Date: 2026-01-22

Description:
Detect and investigate activity that may indicate that an adversary is using faux domains to mislead users into interacting with malicious infrastructure. Monitor DNS, email, and web traffic for permutations of your brand name.

References:
  - https://www.zerofox.com/blog/what-is-digital-risk-monitoring/
  - https://securingtomorrow.mcafee.com/consumer/family-safety/what-is-typosquatting/
  - https://blog.malwarebytes.com/cybercrime/2016/06/explained-typosquatting/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2025-07-28

Description:
This detection identifies behavioral indicators consistent with the Interlock RAT (Remote Access Trojan) malware family. Interlock RAT is a stealthy and modular backdoor primarily used for unauthorized remote control, data exfiltration, and system reconnaissance. The malware typically arrives via phishing campaigns or is dropped by other malware strains. Upon execution, it establishes persistence, connects to a command-and-control (C2) server, and allows attackers full access to the compromised system.

References:
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-203a
  - https://blog.sekoia.io/interlock-ransomware-evolving-under-the-radar/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2025-11-25

Description:
Behavioral detections and hunting content for detecting npm supply chain compromises, including the Shai-Hulud worm and its 2.0 variant.
Focuses on preinstall/postinstall script abuse, credential exfiltration via curl/wget, malicious GitHub Actions workflow injection (shai-hulud-workflow.yml, discussion.yaml), package file patching, cloud credential harvesting, self-hosted runner backdoors, and rapid npm publishing activity.


References:
  - https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack
  - https://www.cisa.gov/news-events/alerts/2025/09/23/widespread-supply-chain-compromise-impacting-npm-ecosystem
  - https://securelist.com/shai-hulud-worm-infects-500-npm-packages-in-a-supply-chain-attack/117547/
  - https://github.com/SigmaHQ/sigma/pull/5658/files
  - https://en.wikipedia.org/wiki/Software_supply_chain_attack
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Bhavin Patel, Splunk
Date: 2017-09-19

Description:
Use the searches in this Analytic Story to help you detect structured query language (SQL) injection attempts characterized by long URLs that contain malicious parameters.

References:
  - https://capec.mitre.org/data/definitions/66.html
  - https://www.incapsula.com/web-application-security/sql-injection.html
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2025-05-25

Description:
Leverage searches that allow you to detect and investigate unusual activities that might relate to malicious Inno Setup-based loaders include monitoring unexpected process trees, script execution, and memory injection patterns originating from installer executables. Inno Setup is a widely used legitimate packaging tool, but its popularity and flexibility make it an attractive vehicle for malware delivery. Malicious actors abuse this framework to create installers that appear benign while hiding and executing embedded payloads. These loaders typically drop encrypted or obfuscated binaries to disk or inject them directly into memory without user consent. These components are typically executed via scripting (e.g., embedded PowerShell, VBScript) or injected directly into memory using process injection techniques like Process Hollowing, Thread Hijacking, or DLL Side-Loading. Some loaders include anti-analysis features such as sandbox evasion, VM detection, or delaying execution to avoid early sandbox detection. Their payloads can range from commodity malware (infostealers, keyloggers, remote access trojans) to custom backdoors.


References:
  - https://x.com/Unit42_Intel/status/[PII_REDACTED]76199869
  - https://www.esentire.com/blog/d3f-ck-loader-the-new-maas-loader
  - https://tria.ge/241129-lgghqaxqgz
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2023-10-01

Description:
A critical security advisory was released by Progress Software on September 27, 2023, concerning multiple vulnerabilities in WS_FTP Server, a widely-used secure file transfer solution. The two critical vulnerabilities are CVE-2023-40044, a .NET deserialization flaw, and CVE-2023-42657, a directory traversal vulnerability. Rapid7 has observed active exploitation of these vulnerabilities. Affected versions are prior to 8.7.4 and 8.8.2. Immediate action is advised - upgrade to WS_FTP Server version 8.8.2. For those unable to update, disabling the Ad Hoc Transfer module is suggested as a temporary measure. This comes in the wake of increased scrutiny following the Cl0p ransomware attack on MOVEit Transfer in May 2023.

References:
  - https://www.assetnote.io/resources/research/rce-in-progress-ws-ftp-ad-hoc-via-iis-http-modules-cve-2023-40044
  - https://community.progress.com/s/article/WS-FTP-Server-Critical-Vulnerability-September-2023
  - https://www.cve.org/CVERecord?id=CVE-2023-40044
  - https://www.rapid7.com/blog/post/2023/09/29/etr-critical-vulnerabilities-in-ws_ftp-server/
  - https://www.splunk.com/en_us/blog/security/fantastic-iis-modules-and-how-to-find-them.html
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Bhavin Patel, Splunk
Date: 2020-02-04

Description:
Quickly identify systems running new or unusual processes in your environment that could be indicators of suspicious activity. Processes run from unusual locations, those with conspicuously long command lines, and rare executables are all examples of activities that may warrant deeper investigation.

References:
  - https://web.archive.org/web/[PII_REDACTED]3439/https://www.fireeye.com/blog/threat-research/2017/08/monitoring-windows-console-activity-part-two.html
  - https://www.splunk.com/pdfs/technical-briefs/advanced-threat-detection-and-response-tech-brief.pdf
  - https://www.sans.org/reading-room/whitepapers/logging/detecting-security-incidents-windows-workstation-event-logs-34262
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2024-03-14

Description:
Leverage searches that allow you to detect and investigate unusual activities that might relate to the cyclopsblink malware including firewall modification, spawning more process, botnet c2 communication, defense evasion and etc. Cyclops Blink is a Linux ELF executable compiled for 32-bit x86 and PowerPC architecture that has targeted several network devices. The complete list of targeted devices is unknown at this time, but WatchGuard FireBox has specifically been listed as a target. The modular malware consists of core components and modules that are deployed as child processes using the Linux API fork. At this point, four modules have been identified that download and upload files, gather system information and contain updating mechanisms for the malware itself. Additional modules can be downloaded and executed from the Command And Control (C2) server.

References:
  - https://www.ncsc.gov.uk/files/Cyclops-Blink-Malware-Analysis-Report.pdf
  - https://www.trendmicro.com/en_us/research/22/c/cyclops-blink-sets-sights-on-asus-routers--.html
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2023-02-01

Description:
Adversaries may steal or forge certificates used for authentication to access remote systems or resources. Digital certificates are often used to sign and encrypt messages and/or files. Certificates are also used as authentication material.

References:
  - https://attack.mitre.org/techniques/T1649/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2024-12-17

Description:
Crypto Stealer is a malware strain designed to exfiltrate cryptocurrency-related data from compromised systems. It scans the infected machine for wallet files, clipboard activity, and other cryptocurrency artifacts, focusing on intercepting sensitive information like private keys or transaction details. The malware communicates with a command-and-control (C2) server to transmit the harvested data and can dynamically adapt its behavior based on instructions received. Detection indicators include unusual network activity to suspicious IP addresses, unauthorized file access targeting cryptocurrency wallet directories, and anomalous clipboard usage associated with cryptocurrency strings (e.g., wallet addresses). Security solutions should monitor for these behaviors and implement heuristic analysis to identify deviations from normal system operations. Users are encouraged to maintain updated endpoint protection and avoid downloading files from untrusted sources to mitigate the risk posed by Crypto Stealer.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2023-01-24

Description:
Leverage searches that allow you to detect and investigate unusual activities that might relate to the AwfulShred malware including wiping files, process kill, system reboot via system request, shred,  and service stops.

References:
  - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/overview-of-the-cyber-weapons-used-in-the-ukraine-russia-war/
  - https://cert.gov.ua/article/3718487
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Bhavin Patel, Michael Haag, Splunk
Date: 2025-08-21

Description:
This analytic story focuses on detecting exploitation attempts and successful compromises related to CVE-2018-0171, a critical vulnerability in Cisco's Smart Install feature. This vulnerability allows unauthenticated, remote attackers to execute arbitrary code on affected devices or trigger device reloads resulting in denial of service conditions. Recently highlighted by Cisco Talos as being actively exploited by the Russian state-sponsored threat actor "Static Tundra," this vulnerability continues to be a significant threat vector for organizations with unpatched or end-of-life network devices.

References:
  - https://blog.talosintelligence.com/static-tundra/
  - https://github.com/AlrikRr/Cisco-Smart-Exploit
  - https://github.com/hellowenying/CVE2018-0171
  - https://www.exploit-db.com/exploits/44451
  - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-smi2
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2022-01-19

Description:
This analytic story contains detections that allow security analysts to detect and investigate unusual activities that might relate to the destructive malware targeting Ukrainian organizations also known as "WhisperGate". This analytic story looks for suspicious process execution, command-line activity, downloads, DNS queries and more.

References:
  - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
  - https://medium.com/s2wblog/analysis-of-destructive-malware-whispergate-targeting-ukraine-9d5d158f19f3
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2024-07-24

Description:
This analytic story covers the detection and analysis of Gozi malware, also known as Ursnif or ISFB. Gozi is one of the oldest and most persistent banking trojans, with a history dating back to 2000. It has undergone numerous evolutions and code forks, resulting in several active variants in recent years.

References:
  - https://malpedia.caad.fkie.fraunhofer.de/details/win.gozi
  - https://thedfirreport.com/2023/01/09/unwrapping-ursnifs-gifts/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2023-10-24

Description:
A critical security update, CVE-2023-4966, has been released for NetScaler ADC and NetScaler Gateway. This vulnerability, discovered by our internal team, can result in unauthorized data disclosure if exploited. Reports of incidents consistent with session hijacking have been received. The Cybersecurity and Infrastructure Security Agency (CISA) has added an entry for CVE-2023-4966 to its Known Exploited and Vulnerabilities Catalog. No workarounds are available for this vulnerability, and immediate installation of the recommended builds is strongly advised.

References:
  - https://www.netscaler.com/blog/news/cve-2023-4966-critical-security-update-now-available-for-netscaler-adc-and-netscaler-gateway/
  - https://support.citrix.com/article/CTX579459/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20234966-and-cve20234967
  - https://www.assetnote.io/resources/research/citrix-bleed-leaking-session-tokens-with-cve-2023-4966
  - https://github.com/assetnote/exploits/tree/main/citrix/CVE-2023-4966
  - https://github.com/projectdiscovery/nuclei-templates/blob/b815d23b908de[PII_REDACTED]3091395d1c89fbeea/http/cves/2023/CVE-2023-4966.yaml
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2024-05-16

Description:
CVE-2024-4040 identifies a critical server-side template injection vulnerability in all versions of CrushFTP prior to 10.7.1 and 11.1.0, allowing unauthenticated remote attackers to execute arbitrary code, bypass authentication, and access files outside of the VFS Sandbox.

References:
  - https://github.com/airbus-cert/CVE-2024-4040
  - https://www.bleepingcomputer.com/news/security/crushftp-warns-users-to-patch-exploited-zero-day-immediately/
  - https://nvd.nist.gov/vuln/detail/CVE-2025-31161
  - https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update
  - https://www.huntress.com/blog/crushftp-cve-2025-31161-auth-bypass-and-post-exploitation
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Nasreddine Bencherchali, Splunk
Date: 2025-01-28

Description:
Adversaries often attempt to manipulate Windows audit policies to disable or suppress logging, allowing malicious activities to go undetected. This analytic story covers groups searches that are designed to monitor and detect suspicious actions involving `auditpol.exe` or other methods used to modify, clear, or remove audit policy configurations.

References:
  - https://www.microsoft.com/en-us/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
  - https://www.cybereason.com/blog/research/prometei-botnet-exploiting-microsoft-exchange-vulnerabilities
  - https://attack.mitre.org/techniques/T1562/002/
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/auditpol-clear
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/auditpol-remove
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: David Dorsey, Splunk
Date: 2026-01-22

Description:
Attackers are finding stealthy ways "live off the land," leveraging utilities and tools that come standard on the endpoint--such as PowerShell--to achieve their goals without downloading binary files. These searches can help you detect and investigate PowerShell command-line options that may be indicative of malicious intent.

References:
  - https://blogs.mcafee.com/mcafee-labs/malware-employs-powershell-to-infect-systems/
  - https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2023-08-23

Description:
In July 2023, a significant vulnerability, CVE-2023-29298, affecting Adobe ColdFusion was uncovered by Rapid7, shedding light on an access control bypass mechanism. This vulnerability allows attackers to access sensitive ColdFusion Administrator endpoints by exploiting a flaw in the URL path validation. Disturbingly, this flaw can be chained with another critical vulnerability, CVE-2023-26360, which has been actively exploited. The latter enables unauthorized arbitrary code execution and file reading. Adobe has promptly addressed these vulnerabilities, but the intricacies and potential ramifications of their combination underscore the importance of immediate action by organizations. With active exploitation in the wild and the ability to bypass established security measures, the situation is alarming. Organizations are urged to apply the updates provided by Adobe immediately, considering the active threat landscape and the severe implications of these chained vulnerabilities.

References:
  - https://helpx.adobe.com/security/products/coldfusion/apsb23-25.html
  - https://twitter.com/stephenfewer/status/[PII_REDACTED]26886400?s=20
  - https://www.rapid7.com/blog/post/2023/07/11/cve-2023-29298-adobe-coldfusion-access-control-bypass
  - https://www.bleepingcomputer.com/news/security/cisa-warns-of-adobe-coldfusion-bug-exploited-as-a-zero-day/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2021-03-26

Description:
Adversaries may abuse BITS jobs to persistently execute or clean up after malicious payloads.

References:
  - https://attack.mitre.org/techniques/T1197/
  - https://docs.microsoft.com/en-us/windows/win32/bits/bitsadmin-tool
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2024-09-24

Description:
This analytic story covers various vulnerabilities identified in Ivanti Endpoint Manager (EPM), including but not limited to SQL injection, remote code execution, and privilege escalation. These vulnerabilities can potentially be exploited by adversaries to gain unauthorized access, execute arbitrary code, and compromise the security of managed endpoints.

References:
  - https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-29824-deep-dive-ivanti-epm-sql-injection-remote-code-execution-vulnerability/
  - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-29824
  - https://github.com/projectdiscovery/nuclei-templates/pull/10020/files
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Mauricio Velazco, Splunk
Date: 2022-04-28

Description:
KrbRelayUp is a tool that allows local privilege escalation from low-priviliged domain user to local system on domain-joined computers.

References:
  - https://github.com/Dec0ne/KrbRelayUp
  - https://gist.github.com/tothi/bf6c59d6de5d0c9710f23dae5750c4b9
  - https://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html
  - https://dirkjanm.io/relaying-kerberos-over-dns-with-krbrelayx-and-mitm6/
  - https://github.com/cube0x0/KrbRelay
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Rico Valdez, Splunk
Date: 2020-01-22

Description:
Monitor for suspicious activities associated with DHS Technical Alert US-CERT TA18-074A. Some of the activities that adversaries used in these compromises included spearfishing attacks, malware, watering-hole domains, many and more.

References:
  - https://www.us-cert.gov/ncas/alerts/TA18-074A
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2022-03-30

Description:
Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components.

References:
  - https://redcanary.com/blog/tracking-driver-inventory-to-expose-rootkits/
  - https://www.trendmicro.com/en_us/research/22/e/avoslocker-ransomware-variant-abuses-driver-file-to-disable-anti-Virus-scans-log4shell.html
  - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/daxin-backdoor-espionage
  - https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064459/Equation_group_questions_and_answers.pdf
  - https://www.welivesecurity.com/2022/01/11/signed-kernel-drivers-unguarded-gateway-windows-core/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Teoderick Contreras, Splunk
Date: 2022-05-31

Description:
On Monday May 30, 2022, Microsoft issued CVE-2022-30190 regarding the Microsoft Support Diagnostic Tool (MSDT) in Windows vulnerability.

References:
  - https://msrc-blog.microsoft.com/2022/05/30/guidance-for-cve-2022-30190-microsoft-support-diagnostic-tool-vulnerability/
  - https://isc.sans.edu/diary/rss/28694
  - https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e
  - https://twitter.com/nao_sec/status/[PII_REDACTED]79401984?s=20&t=ZiXYI4dQuA-0_dzQzSUb3A
  - https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2022-11-16

Description:
CISA and the FBI have identified an APT activity where the adversary gained initial access via Log4Shell via a unpatched VMware Horizon server. From there the adversary moved laterally and continued to its objective.

References:
  - https://www.cisa.gov/uscert/ncas/alerts/aa22-320a
  - https://www.cisa.gov/uscert/sites/default/files/publications/aa22-320a_joint_csa_iranian_government-sponsored_apt_actors_compromise_federal%20network_deploy_crypto%20miner_credential_harvester.pdf
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Mauricio Velazco, Bhavin Patel, Splunk
Date: 2023-01-19

Description:
Monitor for activities and techniques associated with Compromised User Account attacks.

References:
  - https://www.proofpoint.com/us/threat-reference/compromised-account