deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2025-08-22

Description:
ObjectivyStealer is an information-stealing malware designed to extract sensitive data from infected endpoints. It commonly targets web browsers, messaging applications, cryptocurrency wallets, and local system files to gather stored credentials, cookies, autofill data, and session tokens. The malware often arrives via phishing emails, malicious attachments, cracked software, or drive-by downloads. Upon execution, ObjectivyStealer attempts to evade detection by operating from user profile or temporary directories and leveraging obfuscation to disguise its activity. Persistence is typically established through registry run keys or scheduled tasks, ensuring it remains active after system reboots. Detection is primarily achieved through endpoint monitoring of abnormal process behaviors, including unauthorized access to browser storage files, creation of unusual persistence artifacts, and suspicious outbound network connections. Analysts may also identify compressed or encrypted data being exfiltrated to remote command-and-control (C2) infrastructure. Timely detection is critical, as successful infections can result in credential theft, financial fraud, or additional malware deployment.

References:
  - https://www.trellix.com/blogs/research/a-deep-dive-into-obj3ctivitystealers-features/
  - https://www.esentire.com/blog/ande-loader-leads-to-0bj3ctivity-stealer-infection
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Bhavin Patel, Splunk
Date: 2021-05-12

Description:
Leverage searches that allow you to detect and investigate unusual activities that might relate to the DarkSide Ransomware

References:
  - https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/
  - https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2026-02-03

Description:
Leverage searches that allow you to detect and investigate activities related to Lotus Blossom's Chrysalis backdoor supply chain attack.
Monitor for DLL side-loading abuse of Bitdefender Submission Wizard, TinyCC shellcode execution with suspicious command-line flags, BluetoothService persistence in user directories, and system information collection via whoami/systeminfo commands.
Investigate unusual process execution patterns, NSIS installer deployments to suspicious paths, and malicious service installations.
Combining behavioral detections with threat intelligence enables early identification of Lotus Blossom tradecraft, including custom loaders, Microsoft Warbird abuse, and C2 communications mimicking legitimate API traffic patterns.


References:
  - https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/
  - https://securelist.com/notepad-supply-chain-attack/118708/
  - https://attack.mitre.org/groups/G0065/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Bhavin Patel, Splunk
Date: 2018-03-12

Description:
Detect and investigate dormant user accounts for your AWS environment that have become active again. Because inactive and ad-hoc accounts are common attack targets, it's critical to enable governance within your environment.

References:
  - https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf
  - https://redlock.io/blog/cryptojacking-tesla
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Rico Valdez, Splunk
Date: 2017-09-12

Description:
Adversaries often try to cover their tracks by manipulating Windows logs. Use these searches to help you monitor for suspicious activity surrounding log files--an essential component of an effective defense.

References:
  - https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/
  - https://zeltser.com/security-incident-log-review-checklist/
  - http://journeyintoir.blogspot.com/2013/01/re-introducing-usnjrnl.html
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick ContrerasSplunk
Date: 2025-08-20

Description:
This analytic story identifies activity linked to PathWiper, a destructive malware that targeted organizations in Ukraine. The attack typically begins with the execution of a malicious VBScript (e.g., uacinstall.vbs) delivered through a legitimate remote management tool. The script drops and launches a disguised payload such as sha256sum.exe. Once active, PathWiper enumerates local drives, volumes, and even disconnected network shares. It then attempts to dismount volumes and overwrites critical NTFS structures and boot sector, with random data, leaving the system unbootable and data irrecoverable.

References:
  - https://blog.talosintelligence.com/pathwiper-targets-ukraine/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2024-06-17

Description:
ShrinkLocker is a new ransomware that uses Windows BitLocker to encrypt files by creating new boot partitions. It targets non-boot partitions, shrinks them, and creates new boot volumes. ShrinkLocker has attacked a government entity and companies in the vaccine and manufacturing sectors. The ransomware doesn't drop a ransom note but uses the boot partition label to provide contact emails for the attackers. Kaspersky researchers emphasize secure recovery key storage and offline backups to mitigate such threats.

References:
  - https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/do-more-with-tunnels/trycloudflare/
  - https://www.techradar.com/pro/security/a-new-ransomware-is-hijacking-windows-bitlocker-to-encrypt-and-steal-files
  - https://www.bleepingcomputer.com/news/security/new-shrinklocker-ransomware-uses-bitlocker-to-encrypt-your-files/
  - https://securelist.com/ransomware-abuses-bitlocker/112643/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Rico Valdez, Splunk
Date: 2017-11-02

Description:
Windows services are often used by attackers for persistence and the ability to load drivers or otherwise interact with the Windows kernel. This Analytic Story helps you monitor your environment for indications that Windows services are being modified or created in a suspicious manner.

References:
  - https://attack.mitre.org/wiki/Technique/T1050
  - https://attack.mitre.org/wiki/Technique/T1031
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Nasreddine Bencherchali, Splunk
Date: 2025-01-21

Description:
This analytic story focuses on identifying behaviors associated with the misuse of security solution utilities, such as antivirus (AV) and endpoint detection and response (EDR) tools, on endpoints. Adversaries often exploit these utilities to disable critical security services, modify configurations, or execute defense evasion actions. Such activities are typically aimed at bypassing detection mechanisms, disrupting incident response efforts, and maintaining persistence within a compromised environment. By monitoring for these suspicious behaviors, this story empowers security teams to detect, investigate, and respond to potential tampering or manipulation of endpoint defenses effectively.

References:
  - https://www.cisco.com/c/en/us/support/docs/security/amp-endpoints/213690-amp-for-endpoint-command-line-switches.html
  - https://techdocs.broadcom.com/us/en/symantec-security-software/endpoint-security-and-management/endpoint-protection/all/appendices/windows-commands-for-the-endpoint-protection-clien-v9567615-d19e6200.html
  - https://learn.microsoft.com/en-us/powershell/module/defender/set-mppreference?view=windowsserver2025-ps
  - https://support.kaspersky.com/keswin/11.1.1/en-US/178723.htm
  - https://ppn.snovvcrash.rocks/pentest/infrastructure/ad/av-edr-evasion/defender
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, AJ King, Splunk
Date: 2025-03-18

Description:
Cactus ransomware is a sophisticated ransomware-as-a-service (RaaS) operation that emerged in March 2023, targeting large enterprises across various industries including finance, manufacturing, IT, and healthcare. The malware is known for its self-encrypting payload, double extortion tactics, and use of living-off-the-land techniques. Cactus operators employ a combination of legitimate remote access tools and malicious frameworks to maximize damage, often using custom encryption techniques and sophisticated persistence mechanisms.

References:
  - https://any.run/malware-trends/cactus
  - https://attack.mitre.org/techniques/T1490/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2024-07-31

Description:
Handala Destructive Wiper detection involves monitoring for suspicious activities such as unexpected `regasm` processes, unauthorized AutoIt script executions, and the dropping of malicious drivers. Indicators such as abrupt system slowdowns, and the creation of unknown files or processes. Early detection of these signs is crucial for mitigating the severe impact of this destructive malware.

References:
  - https://www.trellix.com/blogs/research/handalas-wiper-targets-israel/
  - https://cyberint.com/blog/threat-intelligence/handala-hack-what-we-know-about-the-rising-threat-actor/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2022-04-12

Description:
Leverage searches that allow you to detect and investigate unusual activities that might relate to the AgentTesla malware including .chm application child process, ftp/smtp connection, persistence and many more. AgentTesla is one of the advanced remote access trojans (RAT) that are capable of stealing sensitive information from the infected or targeted host machine. It can collect various types of data, including browser profile information, keystrokes, capture screenshots and vpn credentials. AgentTesla has been active malware since 2014 and often delivered as a malicious attachment in phishing emails.It is also the top malware in 2021 based on the CISA report.

References:
  - https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla
  - https://cert.gov.ua/article/861292
  - https://www.cisa.gov/uscert/ncas/alerts/aa22-216a
  - https://www.joesandbox.com/analysis/702680/0/html
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Gowthamaraj Rajendran, Splunk
Date: 2023-09-27

Description:
This analytic story focuses on the Microsoft SharePoint Server vulnerability CVE-2023-29357, which allows for an elevation of privilege due to improper handling of authentication tokens. Exploitation of this vulnerability could lead to a serious security breach where an attacker might gain privileged access to the SharePoint environment, potentially leading to data theft or other malicious activities. This story is associated with the detection `Microsoft SharePoint Server Elevation of Privilege` which identifies attempts to exploit this vulnerability.

References:
  - https://socradar.io/microsoft-sharepoint-server-elevation-of-privilege-vulnerability-exploit-cve-2023-29357/
  - https://github.com/Chocapikk/CVE-2023-29357
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2024-03-21

Description:
Windows AppLocker is a feature that enhances security by allowing administrators to specify which users or groups can run particular applications in their organization based on unique identities of files. This story covers various aspects of monitoring and managing AppLocker policies, including detecting unauthorized software installations, enforcing best practices for software usage, and identifying potential security breaches through advanced threat detection techniques. Through the use of Splunk Enterprise, Splunk Enterprise Security, and Splunk Cloud, organizations can gain insights into AppLocker events, ensuring compliance with corporate security policies and mitigating risks associated with unauthorized applications.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2023-10-30

Description:
Research into leading software revealed vulnerabilities in both Apache Tomcat and the F5 BIG-IP suite. Apache's AJP protocol vulnerability, designated CVE-2022-26377, relates to AJP request smuggling. Successful exploitation enables unauthorized system activities. F5 BIG-IP Virtual Edition exhibited a distinct vulnerability, an authentication bypass in the Traffic Management User Interface (TMUI), resulting in system compromise. Assigned CVE-2023-46747, this vulnerability also arose from request smuggling, bearing similarity to CVE-2022-26377. Given the wide adoption of both Apache Tomcat and F5 products, these vulnerabilities present grave risks to organizations. Remediation and vulnerability detection mechanisms are essential to address these threats effectively.

References:
  - https://www.praetorian.com/blog/refresh-compromising-f5-big-ip-with-request-smuggling-cve-2023-46747/
  - https://github.com/projectdiscovery/nuclei-templates/blob/3b0bb71bd627c6c3139e1d06c866f8402aa228ae/http/cves/2023/CVE-2023-46747.yaml
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2024-12-11

Description:
This analytic story addresses the exploitation of Cleo file transfer software products (LexiCom, VLTrader, and Harmony) through CVE-2024-50623. This vulnerability allows unauthenticated attackers to execute arbitrary system commands through the web interface, potentially leading to remote code execution and system compromise.

References:
  - https://www.rapid7.com/blog/post/2024/12/10/etr-widespread-exploitation-of-cleo-file-transfer-software-cve-2024-50623/
  - https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2022-09-22

Description:
Iranian State Actors Conduct Cyber Operations Against the Government of Albania.

References:
  - https://www.cisa.gov/uscert/ncas/alerts/aa22-264a
  - https://www.cisa.gov/uscert/sites/default/files/publications/aa22-264a-iranian-cyber-actors-conduct-cyber-operations-against-the-government-of-albania.pdf
  - https://www.mandiant.com/resources/blog/likely-iranian-threat-actor-conducts-politically-motivated-disruptive-activity-against
  - https://www.microsoft.com/security/blog/2022/09/08/microsoft-investigates-iranian-attacks-against-the-albanian-government/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2023-01-11

Description:
Leverage searches that allow you to detect and investigate unusual activities that might relate to the Chaos ransomware, including looking for file writes (file encryption and ransomware notes), deleting shadow volume storage, registry key modification, dropping of files in startup folder, and more.

References:
  - https://blog.qualys.com/vulnerabilities-threat-research/2022/01/17/the-chaos-ransomware-can-be-ravaging
  - https://www.fortinet.com/blog/threat-research/chaos-ransomware-variant-in-fake-minecraft-alt-list-brings-destruction
  - https://marcoramilli.com/2021/06/14/the-allegedly-ryuk-ransomware-builder-ryukjoke/
  - https://www.trendmicro.com/en_us/research/21/h/chaos-ransomware-a-dangerous-proof-of-concept.html
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Rod Soto, Splunk
Date: 2020-04-15

Description:
This story addresses detection against Kubernetes cluster fingerprint scan and attack by providing information on items such as source ip, user agent, cluster names.

References:
  - https://github.com/splunk/cloud-datamodel-security-research
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2026-03-12

Description:
QUIETVAULT is a JavaScript‑based credential‑stealing malware identified by Google’s Threat Intelligence Group that targets GitHub and npm tokens by exfiltrating them to a publicly accessible GitHub repository. In addition to stealing these credentials, QUIETVAULT leverages on‑host installed AI CLI tools and crafted AI prompts to search the infected system for other sensitive secrets, which it then also exfiltrates. This reflects a broader trend of threat actors integrating AI‑driven tooling into malware to enhance automated discovery and data theft in real‑world operations, signaling a shift toward more adaptable and intelligent malicious software.

References:
  - https://cloud.google.com/blog/topics/threat-intelligence/threat-actor-usage-of-ai-tools?linkId=60744249
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Rod Soto
Date: 2021-12-03

Description:
This analytic story identifies popular Linux post exploitation tools such as autoSUID, LinEnum, LinPEAS, Linux Exploit Suggesters, MimiPenguin.

References:
  - https://attack.mitre.org/matrices/enterprise/linux/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2022-05-10

Description:
CVE-2022-1388 is a unauthenticated remote code execution vulnerablity against BIG-IP iControl REST API.

References:
  - https://github.com/dk4trin/templates-nuclei/blob/main/CVE-2022-1388.yaml
  - https://www.randori.com/blog/vulnerability-analysis-cve-2022-1388/
  - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1388
  - https://twitter.com/da_667/status/[PII_REDACTED]27250438?s=20&t=-JnB_aNWuJFsmcOmxGUWLQ
  - https://github.com/horizon3ai/CVE-2022-1388/blob/main/CVE-2022-1388.py
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Rod Soto, Splunk
Date: 2020-05-20

Description:
This story addresses detection and response of accounts acccesing Kubernetes cluster sensitive objects such as configmaps or secrets providing information on items such as user user, group. object, namespace and authorization reason.

References:
  - https://www.splunk.com/en_us/blog/security/approaching-kubernetes-security-detecting-kubernetes-scan-with-splunk.html
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2021-12-17

Description:
Monitor for and investigate activities that may be associated with a Linux privilege-escalation attack, including unusual processes running on endpoints, schedule task, services, setuid, root execution and more.

References:
  - https://attack.mitre.org/tactics/TA0004/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Rod Soto, Splunk
Date: 2026-02-04

Description:
Leverage Splunk searches to detect and investigate suspicious and malicious activities within monitored MCP (Model Context Protocol) server deployments. This analytic story addresses detection of malicious tool usage patterns, data exfiltration attempts, privilege escalation, and abuse of legitimate MCP server capabilities.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2023-08-29

Description:
Group-IB Threat Intelligence unit discovered a zero-day vulnerability, CVE-2023-38831, in WinRAR, a popular compression tool. Cybercriminals exploited this vulnerability to deliver various malware families, including DarkMe and GuLoader, by crafting ZIP archives with spoofed extensions, which were then distributed on trading forums. Once the malware was executed, it allowed cybercriminals to withdraw funds from brokers' accounts. RARLAB was immediately notified about the vulnerability and released a patch. Group-IB recommends users update WinRAR to the latest version, stay informed about cyber threats, be cautious with unknown attachments, enable 2FA, backup data, and follow the principle of least privilege.

References:
  - https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/
  - https://nvd.nist.gov/vuln/detail/CVE-2023-38831
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Bhavin Patel, Splunk
Date: 2025-11-18

Description:
This analytics story focuses on identifying suspicious activities and potential security threats within environments using Cisco Isovalent in Kubernetes. It provides detection analytics and guidance to help security teams recognize signs of adversary tactics such as unauthorized access attempts, unusual network activity, and other behaviors indicative of potential compromise in their Kubernetes environments.

References:
  - https://isovalent.com/blog/post/isovalent-splunk-better-together/
  - https://isovalent.com/blog/post/mitre-attack-tetragon/
  - https://www.reddit.com/r/kubernetes/comments/l6e5yr/one_of_our_kubernetes_containers_was_compromised/
  - https://attack.mitre.org/matrices/enterprise/containers/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2021-09-23

Description:
Leverage searches that allow you to detect and investigate unusual activities that might relate to the Remcos RAT trojan, including looking for file writes associated with its payload, screencapture, registry modification, UAC bypassed, persistence and data collection..

References:
  - https://success.trendmicro.com/solution/1123281-remcos-malware-information
  - https://attack.mitre.org/software/S0332/
  - https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos#:~:text=Remcos%20(acronym%20of%20Remote%20Control,used%20to%20remotely%20control%20computers.&text=Remcos%20can%20be%20used%20for,been%20used%20in%20hacking%20campaigns.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2021-12-17

Description:
Monitor for activities and techniques associated with maintaining persistence on a Linux system--a sign that an adversary may have compromised your environment.

References:
  - https://attack.mitre.org/techniques/T1053/
  - https://kifarunix.com/scheduling-tasks-using-at-command-in-linux/
  - https://gtfobins.github.io/gtfobins/at/
  - https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2021-11-12

Description:
Adversaries may use InstallUtil to proxy execution of code through a trusted Windows utility.

References:
  - https://attack.mitre.org/techniques/T1218/004/
  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2023-01-24

Description:
The following analytic story providers visibility into the latest adversary TTPs in regard to the use of Sliver. Sliver has gained more traction with adversaries as it is often seen as an alternative to Cobalt Strike. It is designed to be scalable and can be used by organizations of all sizes to perform security testing. Sliver is highly modular and contains an Extension package manager (armory) allowing easy install (automatic compilation) of various 3rd party tools such as BOFs and .NET tooling like Ghostpack (Rubeus, Seatbelt, SharpUp, Certify, and so forth) (CyberReason,2023).

References:
  - https://www.cybereason.com/blog/sliver-c2-leveraged-by-many-threat-actors
  - https://www.ncsc.gov.uk/files/Advisory%20Further%20TTPs%20associated%20with%20SVR%20cyber%20actors.pdf
  - https://www.proofpoint.com/uk/blog/security-briefs/ta551-uses-sliver-red-team-tool-new-activity
  - https://www.cybereason.com/blog/threat-analysis-report-bumblebee-loader-the-high-road-to-enterprise-domain-control
  - https://github.com/sliverarmory/armory