deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2024-12-23

Description:
A table of previously seen Cloud image IDs
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2024-12-23

Description:
A lookup file that will contain AWS Service accounts
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2024-12-23

Description:
A lookup file that will be used to define the mandatory job for workflow
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2024-12-23

Description:
A list of processes that are not common
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2024-12-23

Description:
A list of suspicious file names
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2025-03-09

Description:
Legitimate browser process executable paths; used to filter out known browsers e.g. when detecting hosts file access.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2024-12-23

Description:
Mapping images to repositories
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2026-01-15

Description:
A list of potentially abused libraries in Windows
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2026-05-04

Description:
A list of tools used by attackers
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Raven Tait, Splunk
Date: 2025-12-16

Description:
A list of user agents used with known user agents associated with RMM tools.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2024-12-23

Description:
A placeholder for the baseline information for AWS security groups
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2024-12-23

Description:
Detect DGA domains using Pretrained Model in DSDL
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2024-12-23

Description:
A placeholder for the list of Windows Services running
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Raven Tait, Splunk
Date: 2025-12-05

Description:
A list of user agents used with known C2 frameworks and toolings.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Steven Dick, Raven Tait
Date: 2025-05-05

Description:
A list of commands and commandlets used with known malicious powershell tooling.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: mthcht, Splunk Threat Research Team
Date: 2025-07-01

Description:
A list of suspicious ports that are used or abused by threat actors, malware or PUA software.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2024-12-23

Description:
A place holder for a list of GCP storage access from remote IPs
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2024-12-23

Description:
A file that contains look-a-like domains for brands that you want to monitor
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2024-12-23

Description:
A table of users, commands, and the first and last time that they have been seen
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2024-12-23

Description:
A lookup file that will contain translations for AD object ace flags strings
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Nasreddine Bencherchali, Splunk Threat Research Team
Date: 2025-07-05

Description:
A list of known typo squatted python packages
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2024-12-23

Description:
A list of interesting files in a local file inclusion attack
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2024-12-23

Description:
A placeholder for a list of AWS accounts and assumed roles
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2025-01-16

Description:
A place holder for a list of previouslyt seen EC2 launches by user
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Raven Tait, Splunk
Date: 2025-12-04

Description:
A list of named pipes used with known suspicious tooling.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2024-12-23

Description:
A place holder for a list of AWS EC2 modifications done by each user
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2024-12-23

Description:
A place holder for a list of used cloud compute instance types
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2024-12-23

Description:
A place holder for a list of used Kuberntes Process Ratios
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2024-12-23

Description:
A list of rare processes that are legitimate provided by the end user
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Nasreddine Bencherchali, Splunk Threat Research Team
Date: 2025-05-28

Description:
A list of secure firewall application detectors metadata related to remote desktop and remote management utilities.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2024-12-23

Description:
A simple conversion matrix for converting to and from UTF8/16 base64/hex/decimal encoding. Created mosty from https://community.splunk.com/t5/Splunk-Search/base64-decoding-in-search/m-p/27572#M177741, with small modifications for UTF16LE parsing for powershell encoding.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2025-10-01

Description:
A list of file extensions that are associated with ransomware
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2024-12-23

Description:
A list of Windows Protocol Handlers
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Bhavin Patel, Nasreddine Bencherchali, Splunk
Date: 2025-09-24

Description:
A list of threats and the number of distinct Snort IDs that should be fired to create an alert
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Steven Dick
Date: 2025-03-26

Description:
A list of suspicious Windows Service names and locations
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Raven Tait, Splunk
Date: 2025-12-05

Description:
A list of named pipes used with known C2 frameworks and toolings.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2025-07-17

Description:
A list of known browser application being targeted for credential extraction.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2024-12-23

Description:
A lookup file that will contain the baseline information for number of blocked outbound connections
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2025-10-10

Description:
A list of user agents that have been marked as suspicious
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2025-12-18

Description:
A list of LOLBAS and their file path used in determining if a script or binary is valid on windows systems.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2024-12-23

Description:
A list of suspicious bash commonly used by attackers via scripts
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2025-12-31

Description:
A full baseline of executable files in Windows\System32 and Windows\Syswow64, including sub-directories from Server 2016 and Windows 10.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2024-12-23

Description:
A list of domains from the 3CX supply chain attack.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Bhavin Patel
Date: 2025-02-14

Description:
A lookup table of decommissioned S3 buckets created by baseline - Baseline of Open S3 Bucket Decommissioning. This lookup table is used by detections searches to trigger alerts when decommissioned buckets are detected.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2025-01-16

Description:
A place holder for a list of used Previously Seen EC2 AMIs
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2025-07-28

Description:
A list of file names that are ransomware note files
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Raven Tait, Splunk
Date: 2025-12-16

Description:
A list of user agents used with unwanted applications.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2024-12-23

Description:
A placeholder for the baseline information for AWS S3 deletions
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2024-12-23

Description:
A list of processes that should not be launching cmd.exe
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2024-12-23

Description:
A lookup file that will be used to define the mandatory step for job
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2024-12-23

Description:
A list of legit domains to be used as an ignore list for possible phishing sites
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2024-12-23

Description:
A full baseline of executable files in \Windows\, including sub-directories from Server 2016 and Windows 11. Certain .net binaries may not have been captured due to different Windows SDK's or developer utilities not installed during baseline.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2025-04-03

Description:
abuse.ch SSLBL SSL Certificate Blacklist (SHA1 Fingerprints)
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2024-12-23

Description:
A lookup file that will contain the baseline information for number of AWS Network ACL Activity
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2026-04-09

Description:
A list of dynammic dns providers that should not be modified
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2024-12-23

Description:
A list of domains that can be ignored
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2024-12-23

Description:
List of GUIDs associated with Windows advanced audit policies
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2024-12-23

Description:
An MLTK model for detecting malicious commandlines
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2024-12-23

Description:
A list of known vulnerable drivers
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2024-12-23

Description:
Detect suspicious DNS txt records using Pretrained Model in DSDL
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2025-01-16

Description:
A place holder for a list of used previously seen EC2 instance types.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2024-12-23

Description:
A list used to provide global exceptions to remote access monitoring content.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2024-12-23

Description:
A list of rare processes that are legitimate that is provided by Splunk
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2025-01-29

Description:
A list of services that deal with security, such as Antivirus, Endpoint Detection and Response, etc.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2024-12-23

Description:
Detect a suspicious processname using Pretrained Model in DSDL
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Raven Tait, Splunk
Date: 2025-12-16

Description:
A list of user agents used with known malware.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2024-12-23

Description:
A table of users seen making instance modifications, and the first and last time that the activity was observed
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2024-12-23

Description:
A lookup to determine if you have a sufficient amount of time has passed to collect cloud instance data for behavioral searches
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2025-01-29

Description:
A lookup file that will contain translations for builtin AD group strings
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2024-12-23

Description:
A collection that will contain the baseline information for number of AWS API calls per user
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2025-01-29

Description:
A csv of the ID and rule name for ASR, Microsoft Attack Surface Reduction rules.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2024-12-23

Description:
A list of processes that have been marked as prohibited
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2024-12-23

Description:
A table of users seen doing console logins, and the first and last time that the activity was observed
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2024-12-23

Description:
A lookup file that will contain translations for AD object ace control access rights guids
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Splunk Threat Research Team
Date: 2024-12-23

Description:
Detect DNS Data Exfiltration using pretrained Model in DSDL
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Bhavin Patel, Nasreddine Bencherchali, Splunk Threat Research Team
Date: 2025-12-08

Description:
Mapping file of Snort IDs to Threats
Sigma Detection Rule: 
Repository: splunk/security_content

Description:
customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environment.
Sigma Detection Rule: 
Repository: splunk/security_content

Description:
search data model's summaries only
Sigma Detection Rule: 
Repository: splunk/security_content

Description:
Used inside security_content_summariesonly to adjust the allow_old_summaries configuration
Sigma Detection Rule: 
Repository: splunk/security_content

Description:
Matches the process with its original file name, data for this macro came from https://strontic.github.io/
Sigma Detection Rule: 
Repository: splunk/security_content

Description:
List of image names which are allowed to be used in the Cisco Isovalent environment. Please customize this macro to your environment to allowlist the images you want to allow.
Sigma Detection Rule: 
Repository: splunk/security_content

Description:
customer specific splunk configurations(eg- index, source, sourcetype) for Kubernetes data. Replace the macro definition with configurations for your Splunk Environment.
Sigma Detection Rule: 
Repository: splunk/security_content

Description:
Use this macro to determine how far back you should be checking for new provisioning activities
Sigma Detection Rule: 
Repository: splunk/security_content

Description:
Use this macro to determine how far back you should be checking for new Windows services
Sigma Detection Rule: 
Repository: splunk/security_content

Description:
convert epoch time to string
Sigma Detection Rule: 
Repository: splunk/security_content

Description:
A listing of processes known to be abused for User Account Control bypass exploitation.
Sigma Detection Rule: 
Repository: splunk/security_content

Description:
Customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
Sigma Detection Rule: 
Repository: splunk/security_content

Description:
Use this macro to determine how far back you should be checking for new zoom child processes
Sigma Detection Rule: 
Repository: splunk/security_content

Description:
This macro is intended to exclude binaries that are common in Kubernetes environments that are known to access the cloud metadata service.
Sigma Detection Rule: 
Repository: splunk/security_content

Description:
Performs the tokenization and application of the malicious commandline classifier
Sigma Detection Rule: 
Repository: splunk/security_content

Description:
Replace the macro definition with configurations for your Splunk Environment. IngressZone should represent internal zones and EgressZone should represent the internet or and untrusted zone.
Sigma Detection Rule: 
Repository: splunk/security_content

Description:
Customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environment.
Sigma Detection Rule: 
Repository: splunk/security_content

Description:
This macro limites the output to file names that have been marked as suspicious
Sigma Detection Rule: 
Repository: splunk/security_content

Description:
This is the base macro for Nginx sourcetypes
Sigma Detection Rule: 
Repository: splunk/security_content

Description:
specify the user allowed to push Images to AWS ECR.
Sigma Detection Rule: 
Repository: splunk/security_content

Description:
Use this macro to determine how long to keep track of cloud instance images
Sigma Detection Rule: 
Repository: splunk/security_content

Description:
customer specific splunk configurations(eg- index, source, sourcetype) for Kubernetes audit data. Replace the macro definition with configurations for your Splunk Environment.
Sigma Detection Rule: 
Repository: splunk/security_content

Description:
Add customer specific known false positives to the map command used in detection - Potential password in username
Sigma Detection Rule: 
Repository: splunk/security_content

Description:
customer specific splunk configurations(eg- index, source, sourcetype) for Cisco Secure Firewall Threat Defense logs. Replace the macro definition with configurations for your Splunk Environment.
Sigma Detection Rule: 
Repository: splunk/security_content

Description:
Define your user groups which are allowed to connect to your kubernetes cluster.
Sigma Detection Rule: 
Repository: splunk/security_content

Description:
This is a list of AWS event names that have to do with modifying Amazon EC2 instances
Sigma Detection Rule: 
Repository: splunk/security_content

Description:
This macro removes valid domains from the output
Sigma Detection Rule: 
Repository: splunk/security_content

Description:
matches known executable file extension
Sigma Detection Rule: 
Repository: splunk/security_content

Description:
Use this macro to determine how long to keep track of cloud api calls per user role
Sigma Detection Rule: 
Repository: splunk/security_content

Description:
Use this macro to determine how long to keep track of Windows services
Sigma Detection Rule: 
Repository: splunk/security_content

Description:
Use this macro to determine how long to keep track of zoom child processes
Sigma Detection Rule: 
Repository: splunk/security_content

Description:
customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk environment.
Sigma Detection Rule: 
Repository: splunk/security_content

Description:
Define your locations which are allowed to connect to your kubernetes cluster.
Sigma Detection Rule: 
Repository: splunk/security_content

Description:
Define your images which are allowed to connect to your kubernetes cluster.
Sigma Detection Rule: 
Repository: splunk/security_content

Description:
Used inside security_content_summariesonly to adjust the summariesonly configuration
Sigma Detection Rule: 
Repository: splunk/security_content

Description:
Define your user names which are allowed to connect to your kubernetes cluster.
Sigma Detection Rule: 
Repository: splunk/security_content

Description:
This is a list of AWS event names that are associated with Network ACLs
Sigma Detection Rule: 
Repository: splunk/security_content

Description:
Macro used with remote access monitoring content to define exception lookup and usage. Returns filtered results based on contents of remote_access_software_usage_exception.csv
Sigma Detection Rule: 
Repository: splunk/security_content

Description:
This macro is designed to simplify the search for AppLocker events by providing a predefined search query. AppLocker, a feature in Windows, helps administrators control which executables, scripts, and libraries can run on their systems. By using this macro, analysts can quickly query AppLocker logs to monitor application control policies and investigate potential unauthorized software executions or policy violations. To modify this macro for a customer environment, you may need to adjust the source field to match the specific log source or index where AppLocker events are stored. Additionally, if the organization uses custom naming conventions or has AppLocker logs aggregated with other data, further refinement of the search query might be necessary to accurately filter for relevant events.
Sigma Detection Rule: 
Repository: splunk/security_content

Description:
Use this macro to determine how long to keep track of cloud regions
Sigma Detection Rule: 
Repository: splunk/security_content

Description:
customer specific splunk configurations to normalized Windows Event Log System 7036 to recover actual services execution. Replace the macro definition with configurations for your Splunk Environment.
Sigma Detection Rule: 
Repository: splunk/security_content

Description:
Content based conversion of UTF8/UTF16 based base64 encoding. Not a full implementation, but good enough for context without additional app installation.
Sigma Detection Rule: 
Repository: splunk/security_content

Description:
This macro is a list of AWS event names associated with security groups
Sigma Detection Rule: 
Repository: splunk/security_content

Description:
Used inside security_content_summariesonly to adjust the fillnull configuration
Sigma Detection Rule: 
Repository: splunk/security_content

Description:
This macro defines non-public (private, reserved, or special-use) IPv4 and IPv6 address blocks as per RFC 1918, RFC 6598, RFC 5737, RFC 3927, RFC 5156, RFC 2544, and others.
These include private LAN, loopback, link-local, reserved multicast, documentation, and certain experimental ranges.
It can be used to filter out internal or non-routable IP addresses in detection searches and analytics.
Update the macro definition if your environment includes unique non-public blocks or excludes any for your specific use case.