deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Mauricio Velazco, Splunk
Date: 2022-07-14

Description:
Monitor for activities and techniques associated with Account Takeover attacks against Azure Active Directory tenants.

References:
  - https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-whatis
  - https://azure.microsoft.com/en-us/services/active-directory/#overview
  - https://attack.mitre.org/techniques/T1586/
  - https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-compare-azure-ad-to-ad
  - https://www.imperva.com/learn/application-security/account-takeover-ato/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2025-03-24

Description:
Seashell Blizzard is a threat actor known for targeting organizations globally through a sophisticated campaign leveraging Exchange Server vulnerabilities, custom tools, and living-off-the-land techniques for persistent access and data collection.

References:
  - https://www.microsoft.com/en-us/security/blog/2025/02/12/the-badpilot-campaign-seashell-blizzard-subgroup-conducts-multiyear-global-access-operation/
  - https://edgewaterit.com/2025/02/20/seashell-blizzard-apt/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2025-07-20

Description:
This analytic story addresses critical vulnerabilities in Microsoft SharePoint that allow attackers to gain unauthorized access, execute code remotely, and elevate privileges. It includes detections for known exploit patterns and post-exploitation activities to help organizations identify and respond to SharePoint-targeted attacks.

References:
  - https://www.cisa.gov/news-events/alerts/2025/07/20/microsoft-releases-guidance-exploitation-sharepoint-vulnerability-cve-2025-53770
  - https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/
  - https://research.eye.security/sharepoint-under-siege/
  - https://socradar.io/microsoft-sharepoint-server-elevation-of-privilege-vulnerability-exploit-cve-2023-29357/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2021-02-16

Description:
Cobalt Strike is threat emulation software. Red teams and penetration testers use Cobalt Strike to demonstrate the risk of a breach and evaluate mature security programs. Most recently, Cobalt Strike has become the choice tool by threat groups due to its ease of use and extensibility.

References:
  - https://www.cobaltstrike.com/
  - https://www.infocyte.com/blog/2020/09/02/cobalt-strike-the-new-favorite-among-thieves/
  - https://bluescreenofjeff.com/2017-01-24-how-to-write-malleable-c2-profiles-for-cobalt-strike/
  - https://blog.talosintelligence.com/2020/09/coverage-strikes-back-cobalt-strike-paper.html
  - https://www.fireeye.com/blog/threat-research/2020/12/unauthorized-access-of-fireeye-red-team-tools.html
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Jose Hernandez, Splunk
Date: 2019-01-09

Description:
Leverage searches that allow you to detect and investigate unusual activities that relate to the ColdRoot Remote Access Trojan that affects MacOS. An example of some of these activities are changing sensative binaries in the MacOS sub-system, detecting process names and executables associated with the RAT, detecting when a keyboard tab is installed on a MacOS machine and more.

References:
  - https://www.intego.com/mac-security-blog/osxcoldroot-and-the-rat-invasion/
  - https://objective-see.com/blog/blog_0x2A.html
  - https://www.bleepingcomputer.com/news/security/coldroot-rat-still-undetectable-despite-being-uploaded-on-github-two-years-ago/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2025-10-31

Description:
Leverage searches that allow you to detect and investigate unusual activities that may be related to Castle RAT, a remote access trojan observed in targeted intrusion campaigns. Castle RAT provides adversaries with capabilities such as remote command execution, file exfiltration, keystroke logging, and screen capture, often delivered via phishing or malicious installers. Detectable indicators include anomalous process parentage (legitimate browsers or system utilities spawned by unknown executables), uncommon command-line switches, persistent autorun entries, and suspicious network connections to uncommon domains or dynamic DNS. Effective investigations correlate process creation events, command-line arguments, network telemetry, and file hashes with endpoint memory and disk forensics to confirm compromise and scope impact, while prioritizing containment and credential resets.

References:
  - https://www.recordedfuture.com/research/from-castleloader-to-castlerat-tag-150-advances-operations
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2024-05-29

Description:
This analytic story includes detections that help security analysts identify and investigate unusual activities associated with the Gomir backdoor malware. Gomir is a sophisticated cyber threat that gains unauthorized access to systems. It communicates with a remote command-and-control (C2) server to execute malicious commands, steal sensitive data, and facilitate further attacks, often evading traditional security measures.

References:
  - https://www.bleepingcomputer.com/news/security/kimsuky-hackers-deploy-new-linux-backdoor-via-trojanized-installers/
  - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/springtail-kimsuky-backdoor-espionage
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Bhavin Patel, Shannon Davis, Splunk
Date: 2023-05-17

Description:
Data exfiltration refers to the unauthorized transfer or extraction of sensitive or valuable data from a compromised system or network during a cyber attack. It is a critical phase in many targeted attacks, where adversaries aim to steal confidential information, such as intellectual property, financial records, personal data, or trade secrets.

References:
  - https://attack.mitre.org/tactics/TA0010/
  - https://bleemb.medium.com/data-exfiltration-with-native-aws-s3-features-c94ae4d13436
  - https://labs.nettitude.com/blog/how-to-exfiltrate-aws-ec2-data/
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-277a
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: David Dorsey, Splunk
Date: 2018-08-20

Description:
Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment.

References:
  - https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2021-03-03

Description:
HAFNIUM group was identified by Microsoft as exploiting 4 Microsoft Exchange CVEs in the wild - CVE-2021-26855, CVE-2021-26857, CVE-2021-26858 and CVE-2021-27065.

References:
  - https://www.splunk.com/en_us/blog/security/detecting-hafnium-exchange-server-zero-day-activity-in-splunk.html
  - https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/
  - https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/
  - https://blog.rapid7.com/2021/03/03/rapid7s-insightidr-enables-detection-and-response-to-microsoft-exchange-0-day/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2021-02-24

Description:
Silver Sparrow, identified by Red Canary Intelligence, is a new forward looking MacOS (Intel and M1) malicious software downloader utilizing JavaScript for execution and a launchAgent to establish persistence.

References:
  - https://redcanary.com/blog/clipping-silver-sparrows-wings/
  - https://www.sentinelone.com/blog/5-things-you-need-to-know-about-silver-sparrow/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Jose Hernandez, Splunk
Date: 2020-11-06

Description:
Leverage searches that allow you to detect and investigate unusual activities that might relate to the Ryuk ransomware, including looking for file writes associated with Ryuk, Stopping Security Access Manager, DisableAntiSpyware registry key modification, suspicious psexec use, and more.

References:
  - https://www.splunk.com/en_us/blog/security/detecting-ryuk-using-splunk-attack-range.html
  - https://www.crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/
  - https://us-cert.cisa.gov/ncas/alerts/aa20-302a
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Jose Hernandez, Splunk
Date: 2025-02-12

Description:
This analytic story contains detections that monitor AWS S3 bucket configurations, access patterns, and potential security risks, with a specific focus on tracking decommissioned public buckets to prevent bucket hijacking attempts.

References:
  - https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html
  - https://labs.watchtowr.com/8-million-requests-later-we-made-the-solarwinds-supply-chain-attack-look-amateur/
  - https://aws.amazon.com/premiumsupport/knowledge-center/secure-s3-resources/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2025-04-28

Description:
This Analytic Story covers the detection of exploitation attempts and reconnaissance activity targeting SAP NetWeaver platforms, with a focus on the critical unauthenticated file upload vulnerability CVE-2025-31324 in Visual Composer. Attackers are actively exploiting this flaw to upload arbitrary files—often webshells—via POST requests to the /developmentserver/metadatauploader endpoint, leading to full system compromise, remote code execution, and persistent access. The story includes detections for both probing (e.g., HEAD requests) and active exploitation, and highlights the significant business risks, such as data theft, operational disruption, and potential regulatory impact. Defenders can use this story to monitor, hunt, and respond to suspicious activity across SAP NetWeaver services, helping to identify both initial access and post-exploitation behaviors.


References:
  - https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/
  - https://reliaquest.com/blog/threat-spotlight-reliaquest-uncovers-vulnerability-behind-sap-netweaver-compromise/
  - https://www.rapid7.com/blog/post/2025/04/28/etr-active-exploitation-of-sap-netweaver-visual-composer-cve-2025-31324/
  - https://www.splunk.com/en_us/blog/security/the-final-shell-introducing-shellsweepx.html
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: David Dorsey, Splunk
Date: 2020-02-04

Description:
Monitor for and investigate activities that may be associated with a Windows privilege-escalation attack, including unusual processes running on endpoints, modified registry keys, and more.

References:
  - https://attack.mitre.org/tactics/TA0004/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Rico Valdez, Splunk
Date: 2017-09-11

Description:
Detect instances of prohibited network traffic allowed in the environment, as well as protocols running on non-standard ports. Both of these types of behaviors typically violate policy and can be leveraged by attackers.

References:
  - http://www.novetta.com/2015/02/advanced-methods-to-detect-advanced-cyber-attacks-protocol-abuse/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2021-04-26

Description:
Adversaries may rename legitimate system utilities to try to evade security mechanisms concerning the usage of those utilities.

References:
  - https://attack.mitre.org/techniques/T1036/003/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Rod Soto, Teoderick Contreras, Splunk
Date: 2021-03-17

Description:
Leverage searches that allow you to detect and investigate unusual activities that might relate to the Clop ransomware, including looking for file writes associated with Clope, encrypting network shares, deleting and resizing shadow volume storage, registry key modification, deleting of security logs, and more.

References:
  - https://www.hhs.gov/sites/default/files/analyst-note-cl0p-tlp-white.pdf
  - https://securityaffairs.co/wordpress/115250/data-breach/qualys-clop-ransomware.html
  - https://www.darkreading.com/attacks-breaches/qualys-is-the-latest-victim-of-accellion-data-breach/d/d-id/1340323
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Gowthamaraj Rajendran, Patrick Bareiss, Splunk
Date: 2026-01-22

Description:
This analytic story contains detections that monitor critical alerts data from security tools ingested into Splunk. By correlating these alerts and enriching them with MITRE ATT&CK annotations and other findings and intermediate findings, it offers a nuanced perspective on potential threats and security posture of your organization.

References:
  - https://help.splunk.com/en/splunk-cloud-platform/common-information-model/6.0/data-models/alerts
  - https://help.splunk.com/en/splunk-cloud-platform/common-information-model/6.0/using-the-common-information-model/use-the-common-action-model-to-build-custom-alert-actions
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2026-02-03

Description:
This detection identifies activity associated with an XML runner loader that leverages Microsoft Management Console (MSC) files to execute a malicious payload on a targeted host. The loader abuses legitimate Windows utilities to parse XML content and invoke embedded commands, allowing execution without dropping a traditional executable. This technique helps the threat evade signature-based defenses by blending into normal administrative behavior. Detection focuses on anomalous MSC file execution, suspicious XML structures, and unusual parent-child process relationships indicative of living-off-the-land abuse.

References:
  - https://www.securonix.com/blog/analyzing-fluxconsole-using-tax-themed-lures-threat-actors-exploit-windows-management-console-to-deliver-backdoor-payloads/
  - https://research.checkpoint.com/2019/microsoft-management-console-mmc-vulnerabilities/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2025-06-27

Description:
This malware sample is identified as a destructive disk wiper designed to irreversibly erase data on infected systems. Once executed, it overwrites or corrupts disk partitions, rendering files and operating systems unusable. Often deployed in targeted attacks or sabotage campaigns, it aims to cripple victims by destroying critical data rather than stealing it. Analysis on VirusTotal shows multiple detections labeling it as “Trojan.Wiper” or “DiskWiper,” indicating destructive intent and possible use of raw disk access to bypass file-level recovery. Such tools are frequently employed in cyber warfare, ransomware incidents (as fake “wipers”), or hacktivist attacks to maximize damage and disruption.

References:
  - https://x.com/cyb3rops/status/[PII_REDACTED]05134975
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Rico Valdez, Splunk
Date: 2020-04-02

Description:
Monitor your Okta environment for suspicious activities. Due to the Covid outbreak, many users are migrating over to leverage cloud services more and more. Okta is a popular tool to manage multiple users and the web-based applications they need to stay productive. The searches in this story will help monitor your Okta environment for suspicious activities and associated user behaviors.

References:
  - https://attack.mitre.org/wiki/Technique/T1078
  - https://owasp.org/www-community/attacks/Credential_stuffing
  - https://searchsecurity.techtarget.com/answer/What-is-a-password-spraying-attack-and-how-does-it-work
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2023-05-15

Description:
The FBI has issued a joint advisory concerning the exploitation of a PaperCut MF/NG vulnerability (CVE-2023-27350) by malicious actors, which began in mid-April 2023 and has been ongoing. In early May 2023, a group identifying themselves as the Bl00dy Ransomware Gang targeted vulnerable PaperCut servers within the Education Facilities Subsector. The advisory provides information on detecting exploitation attempts and shares known indicators of compromise (IOCs) associated with the group's activities.

References:
  - https://www.cisa.gov/news-events/alerts/2023/05/11/cisa-and-fbi-release-joint-advisory-response-active-exploitation-papercut-vulnerability
  - https://www.papercut.com/kb/Main/PO-1216-and-PO-1219
  - https://www.horizon3.ai/papercut-cve-2023-27350-deep-dive-and-indicators-of-compromise/
  - https://www.bleepingcomputer.com/news/security/hackers-actively-exploit-critical-rce-bug-in-papercut-servers/
  - https://www.huntress.com/blog/critical-vulnerabilities-in-papercut-print-management-software
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Raven Tait, Splunk
Date: 2025-05-08

Description:
This analytic story contains detections for malicous activity on VMware ESXi. Adversaries who gain access to an ESXi shell or exploit management interfaces may attempt to maintain persistence, disrupt virtual machines, modify security settings, or prepare for lateral movement.

References:
  - https://www.securityweek.com/microsoft-says-ransomware-gangs-exploiting-just-patched-vmware-esxi-flaw/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2024-08-21

Description:
Leverage searches that allow you to detect and investigate unusual activities linked to the MoonPeak malware, particularly focusing on command-and-control (C2) communications, data collection, file execution, and persistence mechanisms. Monitor network traffic for connections to known malicious IP addresses or domains associated with North Korean APT groups. Additionally, identify unexpected registry modifications and the presence of unauthorized binaries to uncover potential MoonPeak infections.

References:
  - https://blog.talosintelligence.com/moonpeak-malware-infrastructure-north-korea/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2026-01-20

Description:
Detects tactics, techniques, and procedures (TTPs) associated with Storm-0501, a financially motivated  ransomware-as-a-service (RaaS) affiliate that has evolved from targeting on-premises environments to  sophisticated hybrid cloud attacks. Storm-0501 has deployed multiple ransomware families including  Hive, BlackCat/ALPHV, Hunters International, LockBit, and most recently Embargo ransomware. The group  is known for targeting government, manufacturing, transportation, law enforcement, and healthcare  sectors, primarily in the United States. This analytic story provides comprehensive detection coverage  for their complete attack chain, from initial credential abuse through Azure AD/Entra ID compromise  and cloud-native ransomware deployment.


References:
  - https://www.microsoft.com/en-us/security/blog/2024/09/26/storm-0501-ransomware-attacks-expanding-to-hybrid-cloud-environments/
  - https://cyble.com/blog/embargo-ransomware/
  - https://aadinternals.com/post/aadbackdoor/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2025-09-18

Description:
This story tracks GhostRedirector, a China‑aligned threat actor that compromises
Windows servers and abuses IIS to deliver SEO fraud alongside a passive C++
backdoor. The actor leverages web application flaws, most notably SQL injection,
to execute PowerShell via sqlserver.exe and retrieve tooling from a shared
staging infrastructure. Persistence and server‑side manipulation are achieved by
installing a native IIS module, while command execution and basic backdoor
capabilities are provided by the Rungan implant. Tooling, including privilege
escalation components, is frequently staged in ProgramData paths and may be
obfuscated or signed to evade controls.


References:
  - https://www.welivesecurity.com/en/eset-research/ghostredirector-poisons-windows-servers-backdoors-side-potatoes/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Nasreddine Bencherchali, Splunk
Date: 2025-04-03

Description:
This analytic story provides a suite of detections built to analyze network traffic logs from Cisco Secure Firewall Threat Defense (FTD) appliances.
The included analytics focus on uncovering suspicious and potentially malicious behavior such as data exfiltration, encrypted command and control (C2) activity, unauthorized tool downloads, repeated connection attempts to blocked destinations, and traffic involving suspicious SSL certificates or file sharing services.
These detections help security teams identify threats that may be missed by traditional rule-based approaches, offering deeper insight into encrypted sessions, protocol misuse, and adversary abuse of legitimate services.


References:
  - https://www.cisco.com/c/en/us/td/docs/security/firepower/741/api/FQE/secure_firewall_estreamer_fqe_guide_740.pdf
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2024-10-24

Description:
Leverage searches that allow you to detect and investigate unusual activities that may be related to the Braodo Stealer malware, a malicious software designed to steal sensitive information from infected systems. This malware typically targets login credentials, browser history, cookies, and stored passwords. Braodo Stealer often infiltrates through phishing campaigns or malicious downloads, enabling attackers to gain unauthorized access to personal and financial data. By monitoring unusual system behaviors, such as unauthorized network connections or data exfiltration, you can help prevent data breaches and mitigate the impact of this threat.

References:
  - https://bazaar.abuse.ch/browse/tag/Braodo/
  - https://g0njxa.medium.com/from-vietnam-to-united-states-malware-fraud-and-dropshipping-98b7a7b2c36d
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2024-08-26

Description:
This analytic story covers the tactics, techniques, and procedures (TTPs) associated with BlackSuit ransomware, as observed in a December 2023 intrusion. The story encompasses the full attack lifecycle, from initial access via Cobalt Strike beacons to lateral movement, credential access, and ultimately the deployment of BlackSuit ransomware. It aims to help security teams detect and respond to similar attacks by focusing on key behaviors such as Cobalt Strike activity, use of tools like ADFind and Sharphound, and the final ransomware deployment phase.

References:
  - https://thedfirreport.com/2024/08/26/blacksuit-ransomware/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2022-06-16

Description:
Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi).

References:
  - https://attack.mitre.org/techniques/T1218/007/