deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2026-03-24

Description:
Gh0st RAT is a long-running Windows remote access trojan family known for full interactive control, surveillance, and data theft.

Variants implement a custom binary wire protocol over TCP (often high ports), peer-to-peer relaying, and modular features such as keylogging, screen and camera capture, audio recording, file management, and remote shell.

Operators frequently achieve persistence via Run keys, services, or scheduled tasks, and may load capability through side-loaded DLLs or abused LOLBins.

Because Gh0st tooling is widely shared and re-branded, detections should emphasize behavioral chains including ingress staging, non-standard process ancestry, unusual outbound sessions, and registry or service changes associated with remote access—rather than brittle file hashes alone.

References:
  - https://malpedia.caad.fkie.fraunhofer.de/details/win.ghost_rat
  - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-rrasm/22ad9f0e-4349-43e0-92b3-37f7a9c7ca41
  - https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf
  - https://www.sentinelone.com/blog/the-curious-case-of-gh0st-malware/
  - https://cloud.google.com/blog/topics/threat-intelligence/demonstrating-hustle/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2023-10-31

Description:
Telekom Security CTI has uncovered a new phishing-driven malware campaign distributing DarkGate malware. This campaign utilizes stolen email threads to trick users into downloading malicious payloads via hyperlinks. An initial false link to Emotet stirred the security community, but deeper analysis confirmed its true identity as DarkGate, with characteristics like AutoIt scripts and a known command-and-control protocol. This report by Fabian Marquardt details the intricate infection mechanisms, including MSI and VBS file deliveries, sophisticated evasion techniques, and a robust configuration extraction method surpassing current standards. The single developer behind DarkGate, active on cybercrime forums, has shifted the malware's use from private to a rent-out model, implying an expected rise in its deployment. Researchers have also developed a decryption technique for the DarkGate malware, which aids in static analysis and detection, though it requires careful validation to avoid false positives.

References:
  - https://github.security.telekom.com/2023/08/darkgate-loader.html
  - https://redcanary.com/blog/intelligence-insights-october-2023
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2025-04-01

Description:
Termite Ransomware is a malicious software strain that recently targeted the supply chain management platform Blue Yonder. It is a sophisticated threat that employs a multi-stage attack strategy. It typically initiates infection via phishing campaigns or compromised websites, exploiting system vulnerabilities to gain access. Once inside the network, Termite Ransomware escalates privileges and deploys robust encryption algorithms to lock down critical files, rendering them inaccessible. A ransom note is then left, instructing victims to pay, even though payment does not guarantee data recovery. The malware is engineered with defense evasion techniques, such as anti-analysis and anti-virtual machine features, complicating detection and forensic analysis.

References:
  - https://www.bleepingcomputer.com/news/security/cisa-confirms-critical-cleo-bug-exploitation-in-ransomware-attacks/
  - https://www.darkreading.com/cyberattacks-data-breaches/termite-ransomware-behind-cleo-zero-day-attacks
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2025-10-14

Description:
Hellcat is a Ransomware-as-a-Service (RaaS) group that emerged in Q4 2024, known for sophisticated attacks targeting critical infrastructure, telecommunications, government entities, and IT organizations. The group employs advanced techniques including PowerShell infection chains, SSH-based persistence, and custom ransomware payloads to compromise and encrypt victim systems.

References:
  - https://www.bridewell.com/insights/blogs/detail/who-are-hellcat-ransomware-group
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2026-03-16

Description:
This analytic story contains detections that allow security analysts to detect and investigate activity associated with Void Manticore (aka Red Sandstorm, Banished Kitten, Handala Hack), an Iranian MOIS-affiliated threat actor.
The story covers initial access via compromised VPN and supply-chain targets, credential dumping and AD reconnaissance, lateral movement over RDP and NetBird tunneling, and destructive operations including custom wipers, PowerShell-based wiping, VeraCrypt disk encryption, and manual data destruction.
Use these analytics to hunt for hands-on-keyboard behavior, default hostnames and wiper or GPO-based execution.


References:
  - https://research.checkpoint.com/2026/handala-hack-unveiling-groups-modus-operandi/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2022-11-30

Description:
Leverage searches that allow you to detect and investigate unusual activities that might relate to the Prestige Ransomware

References:
  - https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2024-04-01

Description:
Leverage searches that allow you to detect and investigate unusual activities that might relate to AcidPour Wiper malware. AcidPour is a destructive variant designed to irreversibly delete data from targeted systems, rendering them inoperable. Unlike ransomware, AcidPour focuses on data destruction, targeting critical storage sectors and overwriting files to make recovery impossible. This malware is capable of wiping and deleting non-standard linux files and overwriting storage device files that might related to router, ssd card and many more.

References:
  - https://www.sentinelone.com/labs/acidpour-new-embedded-wiper-variant-of-acidrain-appears-in-ukraine/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2024-11-28

Description:
Meduza Stealer is a sophisticated and rapidly evolving malware designed to extract sensitive data from compromised systems. Detected primarily through anomalous network activities, its behavior often involves outbound connections to command-and-control (C2) servers, encrypting and exfiltrating stolen credentials, financial data, and other personal information. Analysts have identified Meduza Stealer leveraging advanced evasion techniques, including dynamic obfuscation, anti-analysis methods, and the use of polymorphic code to bypass detection by traditional antivirus systems. Once deployed, it scans for browser-stored passwords, cryptocurrency wallets, and keylogging opportunities, potentially exploiting unpatched software vulnerabilities. Security tools flag it through heuristic detections, anomalous process executions, or unusual registry modifications. Meduza Stealer's malicious payloads are often distributed via phishing emails, malicious attachments, or trojanized software downloads. Effective defense requires a multi-layered security approach, regular software updates, and employee training to minimize risks posed by this potent cyber threat.

References:
  - https://www.fortinet.com/blog/threat-research/exploiting-cve-2024-21412-stealer-campaign-unleashed
  - https://cert.gov.ua/article/6276652
  - https://cert.gov.ua/article/6281018
  - https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-meduza-f1bbd2efb84f
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2023-04-24

Description:
Leverage searches that allow you to detect and investigate unusual activities that might relate to the Redline Stealer trojan, including looking for file writes associated with its payload, screencapture, registry modification, persistence and data collection..

References:
  - https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer
  - https://blogs.blackberry.com/en/2021/10/threat-thursday-redline-infostealer-update
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2021-03-25

Description:
Adversaries may attempt to gather information on domain trust relationships that may be used to identify lateral movement opportunities in Windows multi-domain/forest environments.

References:
  - https://attack.mitre.org/techniques/T1482/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2022-10-26

Description:
A new critical vulnerability CVE-2022-42889 a.k.a. Text4shell, similar to the old Spring4Shell and Log4Shell, was originally reported by Alvaro Munoz on the very popular Apache Commons Text library.

References:
  - https://sysdig.com/blog/cve-2022-42889-text4shell/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2026-02-12

Description:
ZOVWiper is a destructive data-wiping malware identified by ESET researchers, attributed to the threat group Sandworm with high confidence. First observed in November 2025 targeting a financial institution and later in an energy sector incident, ZOVWiper systematically iterates over fixed drives and overwrites file contents to destroy data irrecoverably. The malware skips key system directories and uses size-based overwrite logic to maximize destructive impact. Its deployment highlights ongoing destructive operations against critical infrastructure and financial entities.

References:
  - https://www.welivesecurity.com/en/eset-research/dynowiper-update-technical-analysis-attribution/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2022-04-21

Description:
Leverage searches that allow you to detect and investigate unusual activities that might relate to the Industroyer2 attack, including file writes associated with its payload, lateral movement, persistence, privilege escalation and data destruction.

References:
  - https://cert.gov.ua/article/39518
  - https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Nasreddine Bencherchali, Splunk
Date: 2024-11-13

Description:
Lumma Stealer is a sophisticated information-stealing malware that has been operating as a Malware-as-a-Service (MaaS) platform since 2022. Recent campaigns in 2024 have shown increased sophistication in distribution methods, particularly through fake CAPTCHA verification pages, cracked game downloads, and phishing emails targeting GitHub users. The malware is designed to steal sensitive information including browser credentials, cryptocurrency wallet data, and password manager archives.

References:
  - https://www.cloudsek.com/blog/unmasking-the-danger-lumma-stealer-malware-exploits-fake-captcha-pages
  - https://medium.com/@shaherzakaria8/downloading-trojan-lumma-infostealer-through-capatcha-1f25255a0e71
  - https://securelist.com/fake-captcha-delivers-lumma-amadey/114312/
  - https://www.bleepingcomputer.com/news/security/clever-github-scanner-campaign-abusing-repos-to-push-malware/
  - https://www.trendmicro.com/en_us/research/23/j/beware-lumma-stealer-distributed-via-discord-cdn-.html
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2026-04-16

Description:
This analytic story contains detections that help security analysts identify endpoint activity that may be associated with VIP Keylogger, a .NET-based information stealer and keylogger spread through spear-phishing and impersonation-themed campaigns (for example lures that mimic trusted organizations or urgent business documents).
The malware is built to harvest sensitive data from the victim system and often relies on defense evasion patterns common to modern crimeware, including abuse of trusted Windows and .NET binaries and stealthy persistence.
The searches in this story focus on behavioral signals—such as unusually large values written under user environment-related registry keys and execution of common .NET-related utilities from script parents in low-trust locations—that can indicate this family or closely related .NET stealers.
These analytics are useful for triage and hunting because VIP Keylogger shares substantial overlap in tradecraft and tooling with other subscription-style .NET infostealers, notably Snake Keylogger, including comparable credential-theft goals, delivery themes, and overlapping technical classifications in open-source intelligence.


References:
  - https://www.joesandbox.com/analysis/1817558/0/pdfexecutive
  - https://www.broadcom.com/support/security-center/protection-bulletin/vip-keylogger-spreads-via-multi-org-impersonation-campaign
  - https://malpedia.caad.fkie.fraunhofer.de/details/win.vipkeylogger
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2025-09-30

Description:
Lokibot is a prevalent information-stealing Trojan that primarily targets Windows and Android devices to pilfer sensitive data, including usernames, passwords, cryptocurrency wallets, and banking information. Detection often hinges on identifying its characteristic behaviors and network communications. It is commonly distributed via phishing emails containing malicious attachments (e.g., Office documents, RAR files) or through compromised websites. Once infected, Lokibot employs keylogging to capture credentials and exfiltrates stolen data to its command-and-control (C2) servers, often using HTTP with a distinct User-Agent string like "Mozilla/4.08 (Charon; Inferno)". Suspicious network traffic, unexpected system activity, or the presence of its specific C2 communication patterns are strong indicators of compromise. Antivirus and endpoint detection solutions are crucial for identifying and mitigating Lokibot infections.

References:
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-266a
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Rod Soto, Splunk
Date: 2025-10-05

Description:
Leverage advanced Splunk searches to detect and investigate suspicious activities targeting Ollama local LLM framework, including prompt injection attacks, information extraction attempts, compliance violations, and anomalous user behaviors.

References:
  - https://github.com/rosplk/ta-ollama
  - https://owasp.org/www-project-top-10-for-large-language-model-applications/
  - https://blogs.cisco.com/security/detecting-exposed-llm-servers-shodan-case-study-on-ollama
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2022-04-05

Description:
This analytic story features detections that enable security analysts to identify and investigate unusual activities potentially related to the destructive malware and tools employed by the "Sandworm" group. This analytic story focuses on monitoring suspicious process executions, command-line activities, Master Boot Record (MBR) wiping, data destruction, and other related indicators.

References:
  - https://cert.gov.ua/article/3718487
  - https://attack.mitre.org/groups/G0034/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2024-12-17

Description:
XorDdos is a sophisticated Linux malware that compromises devices to conduct high-capacity Distributed Denial of Service (DDoS) attacks. It employs XOR-based encryption to conceal its communications and utilizes rootkit capabilities to evade detection. The malware typically infiltrates systems through brute-force attacks on SSH services, enabling unauthorized access. Once installed, it can launch DDoS attacks exceeding 150 Gbps. To detect XorDdos, monitor for unusual network traffic patterns, unexpected processes, and unauthorized access attempts. Implementing strong, unique passwords and regularly updating system security measures are essential to mitigate the risk of infection.

References:
  - https://www.securityweek.com/linux-xor-ddos-botnet-flexes-muscles-150-gbps-attacks/
  - https://www.microsoft.com/en-us/security/blog/2022/05/19/rise-in-xorddos-a-deeper-look-at-the-stealthy-ddos-malware-targeting-linux-devices/
  - https://securityintelligence.com/news/xor-ddos-attack-tool-being-used-to-launch-over-20-daily-attacks/?utm_source=chatgpt.com
  - https://unit42.paloaltonetworks.com/new-linux-xorddos-trojan-campaign-delivers-malware/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Rod Soto Splunk
Date: 2021-05-07

Description:
Leverage searches that allow you to detect and investigate unusual activities that might relate to the xmrig monero, including looking for file writes associated with its payload, process command-line, defense evasion (killing services, deleting users, modifying files or folder permission, killing other malware or other coin miner) and hacking tools including Telegram as mean of Command And Control (C2) to download other files. Adversaries may leverage the resources of co-opted systems in order to solve resource intensive problems which may impact system and/or hosted service availability. One common purpose for Resource Hijacking is to validate transactions of cryptocurrency networks and earn virtual currency. Adversaries may consume enough system resources to negatively impact and/or cause affected machines to become unresponsive. (1) Servers and cloud-based (2) systems are common targets because of the high potential for available resources, but user endpoint systems may also be compromised and used for Resource Hijacking and cryptocurrency mining.

References:
  - https://github.com/xmrig/xmrig
  - https://www.getmonero.org/resources/user-guides/mine-to-pool.html
  - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
  - https://blog.checkpoint.com/2021/03/11/february-2021s-most-wanted-malware-trickbot-takes-over-following-emotet-shutdown/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2022-11-16

Description:
The following analytic story describes applications that may be abused to reverse proxy back into an organization, either for persistence or remote access.

References:
  - https://attack.mitre.org/software/S0508/
  - https://www.cisa.gov/uscert/sites/default/files/publications/aa22-320a_joint_csa_iranian_government-sponsored_apt_actors_compromise_federal%20network_deploy_crypto%20miner_credential_harvester.pdf
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2025-08-25

Description:
The following analytic detects LAMEHUG by monitoring unusual endpoint behavior where a Python (often PyInstaller-packaged) process initiates outbound requests to the Hugging Face API, specifically the Qwen 2.5-Coder-32B-Instruct model. Such traffic is abnormal in most enterprise environments and may be embedded with base64-encoded prompts that instruct the malware to generate and execute dynamic Windows commands for reconnaissance and data theft. Detection should also flag execution of AI-generated command chains invoking utilities like systeminfo, net start, tasklist, dsquery, and recursive file copy operations into the %ProgramData%\info\ directory. Additional heuristics include spotting phishing ZIP attachments with .pif binaries disguised as PDF or image viewers, which are commonly used for initial delivery of LameHug.

References:
  - https://cert.gov.ua/article/6284730
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Rod Soto, Splunk
Date: 2023-02-01

Description:
Leverage searches that allow you to detect and investigate unusual activities that might relate to the swift slicer malware including overwriting of files and etc.

References:
  - https://twitter.com/ESETresearch/status/[PII_REDACTED]50729728
  - https://www.welivesecurity.com/2023/01/27/swiftslicer-new-destructive-wiper-malware-ukraine/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Bhavin Patel, Splunk
Date: 2016-09-13

Description:
DNS poses a serious threat as a Denial of Service (DOS) amplifier, if it responds to `ANY` queries. This Analytic Story can help you detect attackers who may be abusing your company's DNS infrastructure to launch amplification attacks, causing Denial of Service to other victims.

References:
  - https://www.us-cert.gov/ncas/alerts/TA13-088A
  - https://www.imperva.com/learn/application-security/dns-amplification/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2025-07-29

Description:
This detection identifies behaviors consistent with NaiLaoLocker, a novel ransomware variant observed in targeted attacks. NaiLaoLocker exhibits typical ransomware behavior, including multi-threaded file encryption using AES-256-CBC, appending a .locked extension to affected files, and dropping customized HTML ransom notes. However, it also includes several unique characteristics, it excludes system-critical files and directories from encryption to maintain host stability and uses SM2, a Chinese elliptic curve encryption standard, to secure the AES keys. The ransomware achieves execution via DLL side-loading, where a legitimate signed binary (usysdiag.exe) is abused to load a malicious DLL (sensapi.dll), which in turn decrypts and executes the core payload. Persistence and stealth are enhanced by mutex creation (Global\lockv7) to avoid re-execution, and the malware attempts to clean up after itself by deleting the loader DLL post-infection. NaiLaoLocker logs activity to a file (lock.log) in the ProgramData directory and makes encrypted files hidden. Analysts should look for unusual DLL loading behavior, AES-encrypted files with .locked extensions, and suspicious command-line or RDP usage in the environment.

References:
  - https://www.fortinet.com/blog/threat-research/nailaolocker-ransomware-cheese
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Rod Soto, Gowthamaraj Rajendran
Date: 2023-10-25

Description:
Leverage searches that allow you to detect and investigate unusual activities that might relate to malicious activity from Zscaler. This also encompasses monitoring for events such as users downloading harmful files or accessing websites that pose a risk to system and network security. Additionally, the narrative extends to the detection of insider threats, ensuring comprehensive protection from both external and internal vulnerabilities. By leveraging Zscaler with Splunk, organizations can fortify their defenses, safeguarding against a wide spectrum of cyber threats and maintaining a secure operational environment.

References:
  - https://threatlibrary.zscaler.com/
  - https://help.zscaler.com/zia/about-threat-categories