deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Bhavin Patel, Splunk
Date: 2025-01-24

Description:
The following analytic has been deprecated. The following analytic identifies the rapid execution of processes used for system network configuration discovery on an endpoint. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process GUIDs, names, parent processes, and command-line executions. This activity is significant as it may indicate an attacker attempting to map the network, which is a common precursor to lateral movement or further exploitation. If confirmed malicious, this behavior could allow an attacker to gain insights into the network topology, identify critical systems, and plan subsequent attacks, potentially leading to data exfiltration or system compromise.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Rico Valdez, Splunk
Date: 2024-11-14

Description:
This search detects writes to the 'System Volume Information' folder by something other than the System process.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Patrick Bareiss, Splunk
Date: 2024-11-14

Description:
This search looks for AWS CloudTrail events from Amazon Security Lake where a user is making successful API calls to view/update/delete the existing password policy in an AWS organization. It is unlikely for a regular user to conduct this operation. These events may potentially be malicious, adversaries often use this information to gain more understanding of the password defenses in place and exploit them to increase their attack surface when a user account is compromised.

References:
  - https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/IAM/password-policy.html
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Rico Valdez, Splunk
Date: 2024-11-14

Description:
This search looks for changes to registry values that control Windows file associations, executed by a process that is not typical for legitimate, routine changes to this area.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Abhinav Mishra, Kumar Sharad and Namratha Sreekanta, Splunk
Date: 2026-02-25

Description:
The following analytic identifies potential DNS data exfiltration using a pre-trained deep learning model. It leverages DNS request data from the Network Resolution datamodel and computes features from past events between the same source and domain. The model generates a probability score (pred_is_exfiltration_proba) indicating the likelihood of data exfiltration. This activity is significant as DNS tunneling can be used by attackers to covertly exfiltrate sensitive data. If confirmed malicious, this could lead to unauthorized data access and potential data breaches, compromising the organization's security posture.

References:
  - https://attack.mitre.org/techniques/T1048/003/
  - https://unit42.paloaltonetworks.com/dns-tunneling-how-dns-can-be-abused-by-malicious-actors/
  - https://en.wikipedia.org/wiki/Data_exfiltration
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Mauricio Velazco, Splunk
Date: 2025-10-21

Description:
The following analytic detects `wmiprvse.exe` spawning a LOLBAS execution process. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events where `wmiprvse.exe` is the parent process and the child process is a known LOLBAS binary. This activity is significant as it may indicate lateral movement or remote code execution by an adversary abusing Windows Management Instrumentation (WMI). If confirmed malicious, this behavior could allow attackers to execute arbitrary code, escalate privileges, or maintain persistence within the environment, posing a severe security risk.

References:
  - https://attack.mitre.org/techniques/T1047/
  - https://www.ired.team/offensive-security/lateral-movement/t1047-wmi-for-lateral-movement
  - https://lolbas-project.github.io/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Teoderick Contreras, Splunk
Date: 2025-02-10

Description:
The following analytic has been deprecated. The following analytic identifies office documents executing macro code. It leverages Sysmon EventCode 7 to detect when processes like WINWORD.EXE or EXCEL.EXE load specific DLLs associated with macros (e.g., VBE7.DLL). This activity is significant because macros are a common attack vector for delivering malicious payloads, such as malware. If confirmed malicious, this could lead to unauthorized code execution, data exfiltration, or further compromise of the system. Disabling macros by default is recommended to mitigate this risk.

References:
  - https://www.joesandbox.com/analysis/386500/0/html
  - https://www.joesandbox.com/analysis/702680/0/html
  - https://bazaar.abuse.ch/sample/02cbc1ab80695fc12ff8822b926957c3a600247b9ca412a137f69cb5716c8781/
  - https://www.fortinet.com/blog/threat-research/latest-remcos-rat-phishing
  - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trojanized-onenote-document-leads-to-formbook-malware/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Bhavin Patel, Splunk
Date: 2024-11-14

Description:
This search looks for web connections to dynamic DNS providers.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Michael Haag, Mauricio Velazco, Rico Valdez, Splunk
Date: 2025-02-10

Description:
**DEPRECATION NOTE** - This search has been deprecated and replaced with `Okta Multiple Users Failing To Authenticate From Ip`. This analytic identifies multiple failed logon attempts from a single IP in a short period of time. Use this analytic to identify patterns of suspicious logins from a single source and filter as needed or use this to drive tuning for higher fidelity analytics.

References:
  - https://developer.okta.com/docs/reference/api/event-types/?q=INVALID_CREDENTIALS
  - https://developer.okta.com/docs/reference/api/system-log/
  - https://attack.mitre.org/techniques/T1110/003/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Jim Apger, Splunk
Date: 2024-11-14

Description:
This search is used to identify the creation of multiple user accounts using the same email domain name.

References:
  - https://splunkbase.splunk.com/app/2734/
  - https://splunkbase.splunk.com/app/1809/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: David Dorsey, Splunk
Date: 2024-11-14

Description:
This search looks for applications on the endpoint that you have marked as uncommon.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Michael Haag, Splunk
Date: 2025-02-10

Description:
The following analytic has been deprecated in favour of a more generic approach in "Windows Office Product Spawned Uncommon Process". The following analytic identifies instances where Microsoft Word (winword.exe) spawns the command prompt (cmd.exe). This behavior is detected using Endpoint Detection and Response (EDR) telemetry, focusing on process creation events where the parent process is winword.exe. This activity is significant because it is uncommon and often associated with spearphishing attacks, where malicious attachments execute commands via cmd.exe. If confirmed malicious, this could allow an attacker to execute arbitrary commands, potentially leading to further system compromise, data exfiltration, or lateral movement within the network.

References:
  - https://app.any.run/tasks/73af0064-a785-4c0a-ab0d-cde593fe16ef/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: David Dorsey, Splunk
Date: 2024-11-14

Description:
This search will detect users creating spikes of API activity in your AWS environment.  It will also update the cache file that factors in the latest data. This search is deprecated and have been translated to use the latest Change Datamodel.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Michael Haag, Mauricio Velazco, Splunk
Date: 2025-02-10

Description:
The following analytic has been deprecated. The following analytic detects the loading of the mshtml.dll module into an Office product, which is indicative of CVE-2021-40444 exploitation. It leverages Sysmon EventID 7 to monitor image loads by specific Office processes. This activity is significant because it can indicate an attempt to exploit a vulnerability in the MSHTML component via a malicious document. If confirmed malicious, this could allow an attacker to execute arbitrary code, potentially leading to system compromise, data exfiltration, or further network penetration.

References:
  - https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/
  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444
  - https://strontic.github.io/xcyclopedia/index-dll
  - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trojanized-onenote-document-leads-to-formbook-malware/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Teoderick Contreras, Splunk
Date: 2024-11-14

Description:
The following analytic detects direct commits or pushes to the master or main branch in a GitHub repository. It leverages GitHub logs to identify events where changes are made directly to these critical branches. This activity is significant because direct modifications to the master or main branch bypass the standard review process, potentially introducing unreviewed and harmful changes. If confirmed malicious, this could lead to unauthorized code execution, security vulnerabilities, or compromised project integrity.

References:
  - https://www.splunk.com/en_us/blog/tips-and-tricks/getting-github-data-with-webhooks.html
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Michael Haag, Splunk
Date: 2025-07-29

Description:
The following analytic detects the use of PowerShell's `DownloadString` method to download files. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs that include command-line details. This activity is significant because `DownloadString` is commonly used in malicious PowerShell scripts to fetch and execute remote code. If confirmed malicious, this behavior could allow an attacker to download and run arbitrary code, potentially leading to unauthorized access, data exfiltration, or further compromise of the affected system.

References:
  - https://docs.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadstring?view=net-5.0
  - https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md
  - https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Rod Soto, Splunk
Date: 2024-11-14

Description:
This search provides information on rare Kubectl calls with IP, verb namespace and object access context
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Michael Haag, Splunk
Date: 2025-02-10

Description:
The following analytic has been deprecated in favour of a more generic approach in "Windows Office Product Spawned Uncommon Process". The following analytic detects any Windows Office Product spawning `bitsadmin.exe`, a behavior often associated with malware families like TA551 and IcedID. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and parent process relationships. This activity is significant because `bitsadmin.exe` is commonly used for malicious file transfers, potentially indicating a malware infection. If confirmed malicious, this activity could allow attackers to download additional payloads, escalate privileges, or establish persistence, leading to further compromise of the affected system.

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1197/T1197.md
  - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trojanized-onenote-document-leads-to-formbook-malware/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Abhinav Mishra, Kumar Sharad and Namratha Sreekanta, Splunk
Date: 2026-03-10

Description:
The following analytic identifies suspicious process names using a pre-trained Deep Learning model. It leverages Endpoint Detection and Response (EDR) telemetry to analyze process names and predict their likelihood of being malicious. The model, a character-level Recurrent Neural Network (RNN), classifies process names as benign or suspicious based on a threshold score of 0.5. This detection is significant as it helps identify malware, such as TrickBot, which often uses randomly generated filenames to evade detection. If confirmed malicious, this activity could indicate the presence of malware capable of propagating across the network and executing harmful actions.

References:
  - https://www.cisa.gov/uscert/ncas/alerts/aa20-302a
  - https://www.splunk.com/en_us/blog/security/random-words-on-entropy-and-dns.html
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Michael Haag, Splunk
Date: 2025-02-10

Description:
The following analytic has been deprecated in favour of a more generic approach in "Windows Office Product Spawned Uncommon Process". The following analytic detects an Office product spawning WScript.exe or CScript.exe. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events where Office applications are the parent processes. This activity is significant because it may indicate the execution of potentially malicious scripts through Office products, a common tactic in phishing attacks and malware delivery. If confirmed malicious, this behavior could lead to unauthorized code execution, data exfiltration, or further system compromise.

References:
  - https://blog.cluster25.duskrise.com/2022/09/23/in-the-footsteps-of-the-fancy-bear-powerpoint-graphite/
  - https://www.fortinet.com/blog/threat-research/latest-remcos-rat-phishing
  - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trojanized-onenote-document-leads-to-formbook-malware/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Teoderick Contreras, Mauricio Velazco, Splunk
Date: 2025-01-24

Description:
The following analytic has been deprecated. The following analytic identifies the execution of `net.exe` or `net1.exe` with command line arguments aimed at obtaining the domain password policy. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it indicates potential reconnaissance efforts by adversaries to gather information about Active Directory password policies. If confirmed malicious, this behavior could allow attackers to understand password complexity requirements, aiding in brute-force or password-guessing attacks, ultimately compromising user accounts and gaining unauthorized access to the network.

References:
  - https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Bhavin Patel, Splunk
Date: 2024-11-14

Description:
This search is used to detect DNS tunneling, by calculating the sum of the length of DNS queries and DNS answers. The search also filters out potential false positives by filtering out queries made to internal systems and the queries originating from internal DNS, Web, and Email servers. Endpoints using DNS as a method of transmission for data exfiltration, Command And Control, or evasion of security controls can often be detected by noting an unusually large volume of DNS traffic.
NOTE:Deprecated because existing detection is doing the same. This detection is replaced with two other variations, if you are using MLTK then you can use this search `ESCU - DNS Query Length Outliers - MLTK - Rule` or use the standard deviation version `ESCU - DNS Query Length With High Standard Deviation - Rule`, as an alternantive.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Patrick Bareiss, Splunk
Date: 2025-02-10

Description:
**DEPRECATION NOTE** - This search has been deprecated and replaced with `O365 Mailbox Email Forwarding Enabled`. The following analytic detects when multiple users have configured a forwarding rule to the same destination to proactively identify and investigate potential security risks related to email forwarding and take appropriate actions to protect the organizations data and prevent unauthorized access or data breaches. This detection is made by a Splunk query to O365 management activity logs with the operation `Set-Mailbox` to gather information about mailbox configurations. Then, the query uses the `spath` function to extract the parameters and rename the "Identity" field as "src_user" and searches for entries where the "ForwardingSmtpAddress" field is not empty, which indicates the presence of a forwarding rule. Next, the analytic uses the `stats` command to group the results by the forwarding email address and count the number of unique source users (`src_user`). Finally, it filters the results and only retains entries where the count of source users (`count_src_user`) is greater than 1, which indicates that multiple users have set up forwarding rules to the same destination. This detection is important because it suggests that multiple users are forwarding emails to the same destination without proper authorization, which can lead to the exposure of sensitive information, loss of data control, or unauthorized access to confidential emails. Investigating and addressing this issue promptly can help prevent data breaches and mitigate potential damage.indicates a potential security risk since multiple users forwarding emails to the same destination can be a sign of unauthorized access, data exfiltration, or a compromised account. Additionally, it also helps to determine if the forwarding rules are legitimate or if they indicate a security incident. False positives can occur if there are legitimate reasons for multiple users to forward emails to the same destination, such as a shared mailbox or a team collaboration scenario. Next steps include further investigation and context analysis to determine the legitimacy of the forwarding rules.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Bhavin Patel, Splunk
Date: 2024-11-14

Description:
The search looks for command-line arguments used to hide a file or directory using the reg add command.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Mauricio Velazco, Splunk
Date: 2025-02-10

Description:
The following analytic has been deprecated. The following analytic detects the execution of `net.exe` or `net1.exe` with command-line arguments used to query elevated domain groups. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it indicates potential reconnaissance efforts by adversaries to identify high-privileged users within Active Directory. If confirmed malicious, this behavior could lead to further attacks aimed at compromising privileged accounts, escalating privileges, or gaining unauthorized access to sensitive systems and data.

References:
  - https://attack.mitre.org/techniques/T1069/002/
  - https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/appendix-b--privileged-accounts-and-groups-in-active-directory
  - https://adsecurity.org/?p=3658
  - https://media.defense.gov/2023/May/24/[PII_REDACTED]/-1/-1/0/CSA_Living_off_the_Land.PDF
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Teoderick Contreras, Splunk
Date: 2025-01-24

Description:
The following analytic has been deprecated. The following analytic detects the execution of reg.exe with the "restore" parameter, indicating an attempt to restore registry backup data on a host. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs and command-line arguments. This activity is significant as it may indicate post-exploitation actions, such as those performed by tools like winpeas, which use "reg save" and "reg restore" to manipulate registry settings. If confirmed malicious, this could allow an attacker to revert registry changes, potentially bypassing security controls and maintaining persistence.

References:
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/quser
  - https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS
  - https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Jason Brewer, Splunk
Date: 2024-11-14

Description:
This search looks for AWS CloudTrail events where a user successfully launches an abnormally high number of instances. This search is deprecated and have been translated to use the latest Change Datamodel.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Michael Haag, Splunk
Date: 2025-01-24

Description:
The following analytic has been deprecated. The following analytic detects MSIExec making network connections over ports 443 or 80. This behavior is identified by correlating process creation events from Endpoint Detection and Response (EDR) agents with network traffic logs. Typically, MSIExec does not perform network communication to the internet, making this activity unusual and potentially indicative of malicious behavior. If confirmed malicious, an attacker could be using MSIExec to download or communicate with external servers, potentially leading to data exfiltration, command and control (C2) communication, or further malware deployment.

References:
  - https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/
  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Bhavin Patel, Splunk
Date: 2024-11-14

Description:
This search will detect DNS requests resolved by unauthorized DNS servers. Legitimate DNS servers should be identified in the Enterprise Security Assets and Identity Framework.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Michael Haag, Splunk
Date: 2025-10-25

Description:
The following analytic detects instances where Java, or Tomcat processes spawn a Linux shell, which may indicate exploitation attempts, such as those related to CVE-2021-44228 (Log4Shell). This detection leverages Endpoint Detection and Response (EDR) telemetry, focusing on process names and parent-child process relationships. This activity is significant as it can signify a compromised Java application, potentially leading to unauthorized shell access. If confirmed malicious, attackers could execute arbitrary commands, escalate privileges, or maintain persistent access, posing a severe threat to the environment.

References:
  - https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/
  - https://gist.github.com/olafhartong/916ebc673ba[PII_REDACTED]64f7e7e1d72