deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Rico Valdez, Splunk
Date: 2020-02-04

Description:
Uncover activity consistent with credential dumping, a technique wherein attackers compromise systems and attempt to obtain and exfiltrate passwords. The threat actors use these pilfered credentials to further escalate privileges and spread throughout a target environment. The included searches in this Analytic Story are designed to identify attempts to credential dumping.

References:
  - https://attack.mitre.org/wiki/Technique/T1003
  - https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for.html
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2022-12-19

Description:
Adversaries may install malicious components that run on Internet Information Services (IIS) web servers to establish persistence.

References:
  - https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/
  - https://attack.mitre.org/techniques/T1505/004/
  - https://www.crowdstrike.com/wp-content/uploads/2022/05/crowdstrike-iceapple-a-novel-internet-information-services-post-exploitation-framework-1.pdf
  - https://unit42.paloaltonetworks.com/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/
  - https://www.secureworks.com/research/bronze-union
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2022-05-19

Description:
Recently disclosed CVE-2022-22954 and CVE-2022-22960 have been identified in the wild abusing VMware products to compromise internet faced devices and escalate privileges.

References:
  - https://attackerkb.com/topics/BDXyTqY1ld/cve-2022-22954/rapid7-analysis
  - https://www.cisa.gov/uscert/ncas/alerts/aa22-138b
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Raven Tait, Splunk
Date: 2025-09-09

Description:
NotDoor is an Outlook backdoor associated with APT28 who is known for breaching organizations across multiple sectors in NATO member states. This analytical story harnesses targeted search methodologies to uncover and investigate activities that could be indicative of NotDoor's presence. These activities include tracking file write operations for dropped macros, scrutinizing registry modifications aimed at establishing persistence mechanisms, monitoring suspicious processes, and other malicious actions.

References:
  - https://lab52.io/blog/analyzing-notdoor-inside-apt28s-expanding-arsenal/
  - https://hackread.com/russian-apt28-notdoor-backdoor-microsoft-outlook/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2021-01-12

Description:
Monitor and detect behaviors used by attackers who leverage trusted developer utilities to execute malicious code.

References:
  - https://attack.mitre.org/techniques/T1127/
  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218/T1218.md
  - https://lolbas-project.github.io/lolbas/Binaries/Microsoft.Workflow.Compiler/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: David Dorsey, Splunk
Date: 2020-02-04

Description:
Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware--spikes in SMB traffic, suspicious wevtutil usage, the presence of common ransomware extensions, and system processes run from unexpected locations, and many others.

References:
  - https://web.archive.org/web/[PII_REDACTED]1258/https://www.carbonblack.com/2017/06/28/carbon-black-threat-research-technical-analysis-petya-notpetya-ransomware/
  - https://www.splunk.com/blog/2017/06/27/closing-the-detection-to-mitigation-gap-or-to-petya-or-notpetya-whocares-.html
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Bhavin Patel, Splunk
Date: 2018-05-07

Description:
Leverage these searches to monitor your AWS network traffic for evidence of anomalous activity and suspicious behaviors, such as a spike in blocked outbound traffic in your virtual private cloud (VPC).

References:
  - https://rhinosecuritylabs.com/aws/hiding-cloudcobalt-strike-beacon-c2-using-amazon-apis/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Rod Soto, Splunk
Date: 2022-03-25

Description:
Caddy Wiper is a destructive payload that detects if its running on a Domain Controller and executes killswitch if detected. If not in a DC it destroys Users and subsequent mapped drives. This wiper also destroys drive partitions inculding boot partitions.

References:
  - https://twitter.com/ESETresearch/status/[PII_REDACTED]86712321
  - https://www.welivesecurity.com/2022/03/15/caddywiper-new-wiper-malware-discovered-ukraine/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2022-09-27

Description:
A social engineering technique called 'MFA Fatigue', aka 'MFA push spam' or 'MFA Exhaustion', is growing more popular with threat actors as it does not require malware or phishing infrastructure and has proven to be successful in attacks.

References:
  - https://www.bleepingcomputer.com/news/security/mfa-fatigue-hackers-new-favorite-tactic-in-high-profile-breaches/
  - https://www.csoonline.com/article/3674156/multi-factor-authentication-fatigue-attacks-are-on-the-rise-how-to-defend-against-them.html
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Shannon Davis, Splunk
Date: 2020-08-05

Description:
Use the searches in this Analytic Story to monitor your GCP Storage buckets for evidence of anomalous activity and suspicious behaviors, such as detecting open storage buckets and buckets being accessed from a new IP. The contextual and investigative searches will give you more information, when required.

References:
  - https://cloud.google.com/blog/products/gcp/4-steps-for-hardening-your-cloud-storage-buckets-taking-charge-of-your-security
  - https://rhinosecuritylabs.com/gcp/google-cloud-platform-gcp-bucket-enumeration/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2021-06-04

Description:
Leverage searches that allow you to detect and investigate unusual activities that might relate to the Revil ransomware, including looking for file writes associated with Revil, encrypting network shares, deleting shadow volume storage, registry key modification, deleting of security logs, and more.

References:
  - https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/
  - https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2024-06-28

Description:
This analytic story addresses the critical authentication bypass vulnerability (CVE-2024-5806) in Progress MOVEit Transfer. The vulnerability allows attackers to impersonate any valid user on the system without proper credentials, potentially leading to unauthorized access, data theft, and system compromise. This story includes detections for key indicators of exploitation attempts, helping security teams identify and respond to potential attacks leveraging this vulnerability.

References:
  - https://labs.watchtowr.com/auth-bypass-in-un-limited-scenarios-progress-moveit-transfer-cve-2024-5806/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Splunk Research Team, Splunk
Date: 2019-04-29

Description:
Detect signs of malicious payloads that may indicate that your environment has been breached via a phishing attack.

References:
  - https://www.fireeye.com/blog/threat-research/2019/04/spear-phishing-campaign-targets-ukraine-government.html
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Nasreddine Bencherchali, Michael Haag, Splunk
Date: 2024-12-06

Description:
This analytic story focuses on detecting potential defense evasion or unauthorized access attempts through tampering with Security Descriptor Definition Language (SDDL) settings. Attackers may modify SDDL configurations to alter permissions on critical system components, such as event logs and services, to obscure their activities or gain unauthorized access. This story includes detections for changes to 'ChannelAccess' and 'CustomSD' registry values, as well as the use of tools like 'sc.exe sdset', 'icacls' and 'subinacl' to modify securable objects (files, registry, services, etc) permissions.

References:
  - https://web.archive.org/web/[PII_REDACTED]1255/https://blog.minerva-labs.com/lockbit-3.0-aka-lockbit-black-is-here-with-a-new-icon-new-ransom-note-new-wallpaper-but-less-evasiveness
  - https://learn.microsoft.com/en-us/troubleshoot/windows-server/group-policy/set-event-log-security-locally-or-via-group-policy
  - https://0xv1n.github.io/posts/scmanager/
  - https://www.sans.org/blog/red-team-tactics-hiding-windows-services/
  - https://news.sophos.com/wp-content/uploads/2020/06/glupteba_final-1.pdf
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2021-07-29

Description:
Leverage searches that allow you to detect and investigate unusual activities that might relate to the IcedID banking trojan, including looking for file writes associated with its payload, process injection, shellcode execution and data collection.

References:
  - https://threatpost.com/icedid-banking-trojan-surges-emotet/165314/
  - https://app.any.run/tasks/48414a33-3d66-4a46-afe5-c2003bb55ccf/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2023-05-10

Description:
The Snake implant is considered the most sophisticated cyber espionage tool designed and used by Center 16 of Russia's Federal Security Service (FSB) for long-term intelligence collection on sensitive targets.

References:
  - https://media.defense.gov/2023/May/09/[PII_REDACTED]/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Bhavin Patel, Splunk
Date: 2017-01-05

Description:
Detect activities and various techniques associated with the abuse of `netsh.exe`, which can disable local firewall settings or set up a remote connection to a host from an infected system.

References:
  - https://docs.microsoft.com/en-us/previous-versions/tn-archive/bb490939(v=technet.10)
  - https://htmlpreview.github.io/?https://github.com/MatthewDemaske/blogbackup/blob/master/netshell.html
  - https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2023-10-12

Description:
PlugX, also referred to as "PlugX RAT" or "Kaba," is a highly sophisticated remote access Trojan (RAT) discovered in 2012. This malware is notorious for its involvement in targeted cyberattacks, primarily driven by cyber espionage objectives. PlugX provides attackers with comprehensive remote control capabilities over compromised systems, granting them the ability to execute commands, collect sensitive data, and manipulate the infected host.

References:
  - https://malpedia.caad.fkie.fraunhofer.de/details/win.plugx
  - https://blog.sekoia.io/my-teas-not-cold-an-overview-of-china-cyber-threat/
  - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/carderbee-software-supply-chain-certificate-abuse
  - https://go.recordedfuture.com/hubfs/reports/cta-2023-0808.pdf
  - https://www.mandiant.com/resources/blog/infected-usb-steal-secrets
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2024-08-19

Description:
This analytic story addresses the critical authentication bypass vulnerability (CVE-2024-7593) in Ivanti Virtual Traffic Manager (vTM). Disclosed in August 2024, this flaw affects vTM versions prior to 22.2R1 and 22.7R2, allowing unauthenticated remote attackers to access the admin panel and create new administrator accounts. Such access could potentially lead to full system compromise. The story provides detections for potential exploitation attempts, focusing on unauthorized account creation and suspicious administrative activities. It aims to help organizations identify and respond to possible attacks leveraging this vulnerability, emphasizing the importance of timely patching and thorough investigation of any suspicious events.

References:
  - https://www.ivanti.com/security/security-advisories/ivanti-virtual-traffic-manager-vtm-cve-2024-7593
  - https://nvd.nist.gov/vuln/detail/CVE-2024-7593
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2025-01-07

Description:
A critical security update, CVE-2025-5777, has been released for NetScaler ADC and NetScaler Gateway. This vulnerability, dubbed "CitrixBleed 2," represents a memory disclosure flaw that can result in unauthorized data disclosure if exploited. Unlike CVE-2023-4966 (the original CitrixBleed), this vulnerability is triggered by sending POST requests with incomplete form data to the /p/u/doAuthentication.do endpoint, causing the device to leak memory contents including session tokens, authentication cookies, and other critical data that can lead to session hijacking and unauthorized access. The Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2025-5777 to its Known Exploited and Vulnerabilities Catalog due to active exploitation in the wild since mid-June 2025. No workarounds are available for this vulnerability, and immediate installation of the recommended builds is strongly advised.

References:
  - https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX693420
  - https://www.netscaler.com/blog/news/critical-security-updates-for-netscaler-netscaler-gateway-and-netscaler-console/
  - https://github.com/mingshenhk/CitrixBleed-2-CVE-2025-5777-PoC-
  - https://horizon3.ai/attack-research/attack-blogs/cve-2025-5777-citrixbleed-2-write-up-maybe/
  - https://labs.watchtowr.com/how-much-more-must-we-bleed-citrix-netscaler-memory-disclosure-citrixbleed-2-cve-2025-5777/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Gowthamaraj Rajendran, Splunk
Date: 2022-07-15

Description:
Identify activity and techniques associated with the Evasion of Defenses within AWS, such as Disabling CloudTrail, Deleting CloudTrail and many others.

References:
  - https://attack.mitre.org/tactics/TA0005/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Rico Valdez, Splunk
Date: 2020-02-04

Description:
Looks for activities and techniques associated with the disabling of security tools on a Windows system, such as suspicious `reg.exe` processes, processes launching netsh, and many others.

References:
  - https://attack.mitre.org/wiki/Technique/T1089
  - https://blog.malwarebytes.com/cybercrime/2015/11/vonteera-adware-uses-certificates-to-disable-anti-malware/
  - https://web.archive.org/web/[PII_REDACTED]4457/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Tools-Report.pdf
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2025-04-16

Description:
This analytic story focuses on the exploitation of a Common Log File System (CLFS) driver vulnerability by the Storm-2460 threat actor. The attack chain involves initial access through a zero-day vulnerability in the Windows CLFS driver, followed by the deployment of PipeMagic malware. The threat actor then leverages various living-off-the-land techniques, including the abuse of MSBuild, CertUtil, and ProcDump, to maintain persistence and exfiltrate data. The attack culminates in ransomware deployment, with the actor taking steps to disable system recovery and clear logs to hinder incident response.

References:
  - https://www.microsoft.com/en-us/security/blog/2024/04/08/storm-2460-targets-windows-clfs-driver-vulnerability/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Bhavin Patel, Splunk
Date: 2020-01-27

Description:
Email remains one of the primary means for attackers to gain an initial foothold within the modern enterprise. Detect and investigate suspicious emails in your environment with the help of the searches in this Analytic Story.

References:
  - https://www.splunk.com/blog/2015/06/26/phishing-hits-a-new-level-of-quality/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2023-07-20

Description:
The CVE-2023-3519 vulnerability in NetScaler (formerly Citrix) Application Delivery Controller (ADC) and NetScaler Gateway has been exploited by threat actors, as detailed in a recent advisory. The unauthenticated remote code execution vulnerability was utilized as a zero-day to establish a webshell on a non-production environment NetScaler ADC appliance within a critical infrastructure organization. This facilitated the execution of discovery on the victim's active directory and the collection and exfiltration of data. The advisory offers a comprehensive examination of the threat actors' tactics, techniques, and procedures (TTPs), alongside recommended detection methods and incident response guidelines. Immediate patch application from Citrix and the use of the detection guidance in the advisory is strongly recommended for critical infrastructure organizations to mitigate system compromises.

References:
  - https://attackerkb.com/topics/si09VNJhHh/cve-2023-3519
  - https://www.cisa.gov/sites/default/files/2023-07/aa23-201a_csa_threat_actors_exploiting_citrix-cve-2023-3519_to_implant_webshells.pdf
  - https://support.citrix.com/article/CTX561482/citrix-adc-and-citrix-gateway-security-bulletin-for-cve20233519-cve20233466-cve20233467
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: David Dorsey, Splunk
Date: 2020-08-25

Description:
Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment.

References:
  - https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Bhavin Patel, Splunk
Date: 2017-09-12

Description:
Validate the security configuration of network infrastructure and verify that only authorized users and systems are accessing critical assets. Core routing and switching infrastructure are common strategic targets for attackers.

References:
  - https://web.archive.org/web/[PII_REDACTED]0040/https://www.fireeye.com/blog/executive-perspective/2015/09/the_new_route_toper.html
  - https://www.cisco.com/c/en/us/about/security-center/event-response/synful-knock.html
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2026-02-09

Description:
CVE-2025-26399 is a critical remote code execution vulnerability in SolarWinds Web Help Desk caused by insecure deserialization in the AjaxProxy component. The flaw allows unauthenticated attackers to execute arbitrary code on vulnerable, internet-exposed systems with high privileges. Because Web Help Desk often runs with elevated access and integrates into internal IT environments, successful exploitation provides a direct entry point into enterprise networks. This analytic story focuses on post-exploitation detection, providing a collection of detections designed to identify malicious activity occurring after initial compromise. The included detections monitor for behaviors such as suspicious process execution, command shell spawning, abnormal child processes from the Web Help Desk service, privilege escalation attempts, lateral movement activity, persistence mechanisms, and outbound command-and-control communications associated with exploitation of CVE-2025-26399.

References:
  - https://www.microsoft.com/en-us/security/blog/2026/02/06/active-exploitation-solarwinds-web-help-desk/
  - https://www.huntress.com/blog/active-exploitation-solarwinds-web-help-desk-cve-2025-26399
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: David Dorsey, Splunk
Date: 2020-09-04

Description:
Detect and investigate suspicious activities by users and roles in your cloud environments.

References:
  - https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf
  - https://redlock.io/blog/cryptojacking-tesla
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2024-01-24

Description:
Phemedrone Stealer is a potent data-stealing malware designed to infiltrate systems discreetly, primarily targeting sensitive user information. Operating with a stealthy modus operandi, it covertly collects and exfiltrates critical data such as login credentials, personal details, and financial information. Notably evasive, Phemedrone employs sophisticated techniques to bypass security measures and remain undetected. Its capabilities extend to exploiting vulnerabilities, leveraging command and control infrastructure, and facilitating remote access. As a formidable threat, Phemedrone Stealer poses a significant risk to user privacy and system integrity, demanding vigilant cybersecurity measures to counteract its malicious activities.

References:
  - https://www.trendmicro.com/en_vn/research/23/b/investigating-the-plugx-trojan-disguised-as-a-legitimate-windows.html
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Raven Tait, Splunk
Date: 2026-02-26

Description:
Monitor for activities and techniques associated with maintaining persistence on a MacOS system--a sign that an adversary may have compromised your environment.

References:
  - https://attack.mitre.org/techniques/T1053/
  - https://www.loobins.io/binaries/defaults/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Nasreddine Bencherchali, Splunk
Date: 2025-07-01

Description:
This analytic story provides a suite of detections built to analyze endpoint-based network telemetry captured by the Cisco Network Visibility Module (NVM).
It focuses on identifying suspicious and potentially malicious activity such as process injection, unauthorized downloads, network connections by non-network-aware processes, and potential command-and-control (C2) behavior, etc.
Leveraging the rich metadata from NVM, including process names, command-line arguments, user context, and module information, these detections provide high-fidelity insights into host behavior and outbound network activity.


References:
  - https://www.cisco.com/c/en/us/td/docs/security/vpn_client/anyconnect/anyconnect42/administration/guide/b_AnyConnect_Administrator_Guide_4-2/b_AnyConnect_Administrator_Guide_4-2_chapter_01100.pdf
  - https://www.cisco.com/c/en/us/td/docs/security/vpn_client/anyconnect/Cisco-Secure-Client-5/admin/guide/nvm-collector-5-1-1-admin-guide.html
  - https://community.cisco.com/t5/security-knowledge-base/cisco-network-visibility-nvm-collector/ta-p/4309825