deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Patrick Bareiss, Splunk
Date: 2025-02-10

Description:
The following analytic has been deprecated in favour of "8bbb7d58-b360-11eb-ba21-acde48001122". The following analytic detects the execution of reg.exe with parameters that export registry keys containing hashed credentials. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions involving reg.exe or cmd.exe with specific registry paths. This activity is significant because exporting these keys can allow attackers to obtain hashed credentials, which they may attempt to crack offline. If confirmed malicious, this could lead to unauthorized access to sensitive accounts, enabling further compromise and lateral movement within the network.

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Michael Haag, Splunk
Date: 2025-10-06

Description:
The following analytic detects the execution of rundll32.exe loading syssetup.dll via the LaunchINFSection function. This method is identified through Endpoint Detection and Response (EDR) telemetry, focusing on command-line executions and process details. This activity is significant as it indicates a potential application control bypass, allowing script code execution from a file. If confirmed malicious, an attacker could execute arbitrary code, potentially leading to privilege escalation, persistence, or further network compromise. Investigate the script content, network connections, and any spawned child processes for further context.

References:
  - https://attack.mitre.org/techniques/T1218/011/
  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.011/T1218.011.md
  - https://lolbas-project.github.io/lolbas/Binaries/Rundll32/
  - https://lolbas-project.github.io/lolbas/Libraries/Syssetup/
  - https://bohops.com/2018/02/26/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: David Dorsey, Splunk
Date: 2024-11-14

Description:
This search looks for AWS provisioning activities from previously unseen IP addresses. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." This search is deprecated and have been translated to use the latest Change Datamodel.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Teoderick Contreras, Splunk
Date: 2025-02-10

Description:
The following analytic identifies instances where `ipconfig.exe`, `systeminfo.exe`, or similar tools are executed by a non-standard parent process, excluding CMD, PowerShell, or Explorer. This detection leverages Endpoint Detection and Response (EDR) telemetry to monitor process creation events. Such behavior is significant as it may indicate adversaries using injected processes to perform system discovery, a tactic observed in FIN7's JSSLoader. If confirmed malicious, this activity could allow attackers to gather critical host information, aiding in further exploitation or lateral movement within the network.

References:
  - https://www.mandiant.com/resources/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation
  - https://attack.mitre.org/groups/G0046/
  - https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Mauricio Velazco, Splunk
Date: 2025-01-13

Description:
The following analytic has been deprecated in favour of two dedicated analytics "4dc3951f-b3f8-4f46-b412-76a483f72277" and "a23a0e20-0b1b-4a07-82e5-ec5f70811e7a" .The following analytic identifies the execution of `net.exe` or `net1.exe` with command-line arguments used to discover remote systems, such as `domain computers /domain`. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. This activity is significant as it indicates potential reconnaissance efforts by adversaries or Red Teams to map out networked systems and Active Directory structures. If confirmed malicious, this behavior could lead to further network exploitation, privilege escalation, or lateral movement within the environment.

References:
  - https://attack.mitre.org/techniques/T1018/
  - https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: David Dorsey, Splunk
Date: 2024-11-14

Description:
The search is used to detect systems that are still vulnerable to the Spectre and Meltdown vulnerabilities.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Michael Haag, Marissa Bower, Splunk
Date: 2024-11-14

Description:
**DEPRECATION NOTE** - This search has been deprecated and replaced with `Okta Multiple Failed MFA Requests For User`. The following analytic identifies an account that has rejected more than 2 Push notifications in a 10 minute window. Modify this query for your environment by upping the count or time window.

References:
  - https://developer.okta.com/docs/reference/api/event-types/?q=user.acount.lock
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Jason Brewer, Splunk
Date: 2024-11-14

Description:
This search looks for AWS CloudTrail events where a user successfully terminates an abnormally high number of instances. This search is deprecated and have been translated to use the latest Change Datamodel.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Michael Haag, Splunk
Date: 2025-02-10

Description:
The following analytic has been deprecated. The following analytic detects Office products writing .cab or .inf files, indicative of CVE-2021-40444 exploitation. It leverages the Endpoint.Processes and Endpoint.Filesystem data models to identify Office applications creating these file types. This activity is significant as it may signal an attempt to load malicious ActiveX controls and download remote payloads, a known attack vector. If confirmed malicious, this could lead to remote code execution, allowing attackers to gain control over the affected system and potentially compromise sensitive data.

References:
  - https://twitter.com/vxunderground/status/[PII_REDACTED]79860992?s=20
  - https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/
  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444
  - https://twitter.com/RonnyTNL/status/[PII_REDACTED]17373699?s=20
  - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trojanized-onenote-document-leads-to-formbook-malware/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Mauricio Velazco, Splunk
Date: 2025-02-10

Description:
The following analytic has been deprecated. The following analytic detects the execution of `net.exe` or `net1.exe` with command-line arguments `user` or `users` to query local user accounts. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it indicates potential reconnaissance efforts by adversaries to enumerate local users, which is a common step in situational awareness and Active Directory discovery. If confirmed malicious, this behavior could lead to further attacks, including privilege escalation and lateral movement within the network.

References:
  - https://attack.mitre.org/techniques/T1087/001/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Michael Haag, Teoderick Contreras, Splunk
Date: 2025-02-10

Description:
The following analytic has been deprecated. The following analytic detects a Microsoft Office product spawning the Windows msdt.exe process. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events where Office applications are the parent process. This activity is significant as it may indicate an attempt to exploit protocol handlers to bypass security controls, even if macros are disabled. If confirmed malicious, this behavior could allow an attacker to execute arbitrary code, potentially leading to system compromise, data exfiltration, or further lateral movement within the network.

References:
  - https://isc.sans.edu/diary/rss/28694
  - https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e
  - https://twitter.com/nao_sec/status/[PII_REDACTED]79401984?s=20&t=ZiXYI4dQuA-0_dzQzSUb3A
  - https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/
  - https://www.virustotal.com/gui/file/4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784/detection
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Michael Haag, Splunk, DipsyTipsy
Date: 2025-10-16

Description:
The following analytic detects the use of wget on Windows, Linux or MacOS to download a file from a remote source and pipe it to bash. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it is commonly associated with malicious actions like coinminers and exploits such as CVE-2021-44228 in Log4j. If confirmed malicious, this behavior could allow attackers to execute arbitrary code, potentially leading to system compromise and unauthorized access to sensitive data.

References:
  - https://www.huntress.com/blog/rapid-response-critical-rce-vulnerability-is-affecting-java
  - https://www.lunasec.io/docs/blog/log4j-zero-day/
  - https://gist.github.com/nathanqthai/01808c569903f41a52e7e7b575caa890
  - https://github.com/MHaggis/notes/blob/master/utilities/warp_pipe_tester.py
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Mauricio Velazco, Splunk
Date: 2025-05-02

Description:
This analytic is deprecated because it is a duplicate of - "Windows Service Created with Suspicious Service Path". The following analytic detects the creation of a Windows Service with its binary path located in public directories using Windows Event ID 7045. This detection leverages logs from the `wineventlog_system` data source, focusing on the `ImagePath` field to identify services installed outside standard system directories. This activity is significant as it may indicate the installation of a malicious service, often used by adversaries for lateral movement or remote code execution. If confirmed malicious, this could allow attackers to execute arbitrary code, maintain persistence, or further compromise the system.

References:
  - https://docs.microsoft.com/en-us/windows/win32/services/service-control-manager
  - https://pentestlab.blog/2020/07/21/lateral-movement-services/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Rico Valdez, Splunk
Date: 2024-11-14

Description:
This search looks for ColdRoot events from the osx-attacks osquery pack.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Teoderick Contreras, Splunk
Date: 2025-02-10

Description:
The following analytic has been deprecated. The following analytic detects suspicious attempts to find private keys, which may indicate an attacker's effort to access sensitive cryptographic information. Private keys are crucial for securing encrypted communications and data, and unauthorized access to them can lead to severe security breaches, including data decryption and identity theft. By monitoring for unusual or unauthorized searches for private keys, this analytic helps identify potential threats to cryptographic security, enabling security teams to take swift action to protect the integrity and confidentiality of encrypted information.

References:
  - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html
  - https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Bhavin Patel, Splunk
Date: 2024-11-14

Description:
This search looks for flags passed to schtasks.exe on the command-line that indicate that task names related to the execution of Bad Rabbit ransomware were created or deleted. Deprecated because we already have a similar detection
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Rico Valdez, Splunk
Date: 2024-11-14

Description:
The search looks for files created with names that have been linked to malicious activity.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Teoderick Contreras, Michael Haag, Splunk, TheLawsOfChaos, Github
Date: 2025-02-10

Description:
The following analytic has been deprecated. The following analytic detects Microsoft Office applications dropping or creating executables or scripts on a Windows OS. It leverages process creation and file system events from the Endpoint data model to identify Office applications like Word or Excel generating files with extensions such as .exe, .dll, or .ps1. This behavior is significant as it is often associated with spear-phishing attacks where malicious files are dropped to compromise the host. If confirmed malicious, this activity could lead to code execution, privilege escalation, or persistent access, posing a severe threat to the environment.

References:
  - https://www.mandiant.com/resources/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation
  - https://attack.mitre.org/groups/G0046/
  - https://www.joesandbox.com/analysis/702680/0/html
  - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trojanized-onenote-document-leads-to-formbook-malware/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Michael Haag, Splunk
Date: 2025-02-10

Description:
The following analytic has been deprecated. The following analytic detects any Windows Office Product spawning `rundll32.exe` without a `.dll` file extension. This behavior is identified using Endpoint Detection and Response (EDR) telemetry, focusing on process and parent process relationships. This activity is significant as it is a known tactic of the IcedID malware family, which can lead to unauthorized code execution. If confirmed malicious, this could allow attackers to execute arbitrary code, potentially leading to data exfiltration, system compromise, or further malware deployment. Immediate investigation and containment are recommended.

References:
  - https://www.joesandbox.com/analysis/395471/0/html
  - https://app.any.run/tasks/cef4b8ba-023c-4b3b-b2ef-6486a44f6ed9/
  - https://any.run/malware-trends/icedid
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Okta, Inc, Michael Haag, Splunk
Date: 2025-02-10

Description:
**DEPRECATION NOTE** - This search has been deprecated and replaced with `Okta ThreatInsight Threat Detected`. The following analytic utilizes Oktas ThreatInsight to identify "PasswordSpray" and any included secondary outcome reasons. This event will trigger when a brute force attempt occurs with unknown usernames attempted.

References:
  - https://help.okta.com/en-us/Content/Topics/Security/threat-insight/configure-threatinsight-system-log.htm
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Jim Apger, Splunk
Date: 2024-11-14

Description:
This search is used to identify user accounts that share a common password.

References:
  - https://en.wikipedia.org/wiki/Session_ID
  - https://en.wikipedia.org/wiki/Session_(computer_science)
  - https://en.wikipedia.org/wiki/HTTP_cookie
  - https://splunkbase.splunk.com/app/1809/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Bhavin Patel, Splunk
Date: 2024-11-14

Description:
This search looks for DNS requests for phishing domains that are leveraging EvilGinx tools to mimic websites.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: David Dorsey, Splunk
Date: 2018-04-09

Description:
This search establishes, on a per-hour basis, the average and the standard deviation of the number of API calls made by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Bhavin Patel, Splunk
Date: 2025-02-27

Description:
This search looks for CloudTrail events where an AWS instance is started and creates a baseline of most recent time (latest) and the first time (earliest) we've seen this region in our dataset grouped by the value awsRegion for the last 30 days
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Jason Brewer, Splunk
Date: 2025-01-16

Description:
This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by ARN, within the last hour. NOTE - This baseline search is deprecated and has been updated to use the Authentication Datamodel
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: David Dorsey, Splunk
Date: 2026-02-25

Description:
This search is used to build a Machine Learning Toolkit (MLTK) model for how many API calls are performed by each user. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of instances created in a small time window.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Rico Valdez, Splunk
Date: 2026-02-25

Description:
This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the length of the command lines observed for each user in the environment. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies outliers in the length of the command line.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Rico Valdez, Splunk
Date: 2020-08-15

Description:
This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Jason Brewer, Splunk
Date: 2019-11-14

Description:
This search is used to build a Machine Learning Toolkit (MLTK) model for how many TerminateInstances users do in the environment. By default, the search uses the last 90 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of TerminateInstances performed by a user in a small time window.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Jason Brewer, Splunk
Date: 2019-11-14

Description:
This search is used to build a Machine Learning Toolkit (MLTK) model for how many RunInstances users do in the environment. By default, the search uses the last 90 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of RunInstances performed by a user in a small time window.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Rico Valdez, Splunk
Date: 2026-02-25

Description:
This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the number of SMB connections observed each hour for every day of week. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search to identify outliers in the number of SMB connections for that hour and day of the week.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: David Dorsey, Splunk
Date: 2025-02-27

Description:
This search is intended to give you a feel for how often backup failures happen in your environments.  Fluctuations in these numbers will allow you to determine when you should investigate.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Rico Valdez, Splunk
Date: 2026-02-25

Description:
This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the length of the DNS queries for each DNS record type observed in the environment. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search, which uses it to identify outliers in the length of the DNS query.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: David Dorsey, Splunk
Date: 2026-02-25

Description:
This search is used to build a Machine Learning Toolkit (MLTK) model for how many instances are destroyed in the environment. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of instances destroyed in a small time window.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: David Dorsey, Splunk
Date: 2025-02-27

Description:
This search is intended to give you a feel for how often successful backups are conducted in your environment. Fluctuations in these numbers will allow you to determine when you should investigate.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: David Dorsey, Splunk
Date: 2025-01-16

Description:
This search builds a table of previously seen ARNs that have launched a EC2 instance.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: David Dorsey, Splunk
Date: 2025-04-18

Description:
This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: David Dorsey, Splunk
Date: 2017-09-15

Description:
This search takes the existing interesting process table from ES, filters out any existing additions added by ESCU and then updates the table with processes identified by ESCU that should be prohibited on your endpoints.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: David Dorsey, Splunk
Date: 2025-02-27

Description:
This search builds a table of previously seen ARNs that have launched a EC2 instance.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: David Dorsey, Splunk
Date: 2026-02-25

Description:
This search is used to build a Machine Learning Toolkit (MLTK) model for how many instances are created in the environment. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of instances created in a small time window.