deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk, 0xC0FFEEEE
Date: 2026-04-15

Description:
The following analytic identifies failed authentication attempts against an Azure AD tenant during the Multi-Factor Authentication (MFA) challenge, specifically flagged by error code 500121. It leverages Azure AD SignInLogs to detect these events. This activity is significant as it may indicate an adversary attempting to authenticate using compromised credentials on an account with MFA enabled. If confirmed malicious, this could suggest an ongoing effort to bypass MFA protections, potentially leading to unauthorized access and further compromise of the affected account.

References:
  - https://attack.mitre.org/techniques/T1621/
  - https://attack.mitre.org/techniques/T1078/004/
  - https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-howitworks
  - https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-sign-in-log-activity-details
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Bhavin Patel, Splunk
Date: 2026-05-04

Description:
The following analytic detects the deletion of AWS CloudTrail logs by identifying `DeleteTrail` events within CloudTrail logs. This detection leverages CloudTrail data to monitor for successful `DeleteTrail` actions, excluding those initiated from the AWS console. This activity is significant because adversaries may delete CloudTrail logs to evade detection and operate stealthily within the compromised environment. If confirmed malicious, this action could allow attackers to cover their tracks, making it difficult to trace their activities and potentially leading to prolonged unauthorized access and further exploitation.

References:
  - https://attack.mitre.org/techniques/T1562/008/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Bhavin Patel
Date: 2026-04-15

Description:
The following analytic identifies high-risk activities within repositories by correlating repository data with risk scores. It leverages findings and intermediate findings created by detections from the Dev Sec Ops analytic stories, summing risk scores and capturing source and user information. The detection focuses on high-risk scores above 100 and sources with more than three occurrences. This activity is significant as it highlights repositories frequently targeted by threats, providing insights into potential vulnerabilities. If confirmed malicious, attackers could exploit these repositories, leading to data breaches or infrastructure compromise.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Bhavin Patel, Gowthamaraj Rajendran, Splunk, PashFW, Github Community
Date: 2026-05-04

Description:
The following analytic detects attempts to impair or disable AWS security services by monitoring specific deletion operations across GuardDuty, AWS WAF (classic and v2), CloudWatch, Route 53, and CloudWatch Logs. These actions include deleting detectors, rule groups, IP sets, web ACLs, logging configurations, alarms, and log streams. Adversaries may perform such operations to evade detection or remove visibility from defenders. By explicitly pairing eventName values with their corresponding eventSource services, this detection reduces noise and ensures that only security-related deletions are flagged. It leverages CloudTrail logs to identify specific API calls like "DeleteLogStream" and "DeleteDetector." This activity is significant because it indicates potential efforts to disable security monitoring and evade detection. If confirmed malicious, this could allow attackers to operate undetected, escalate privileges, or exfiltrate data without triggering security alerts, severely compromising the security posture of the AWS environment.

References:
  - https://docs.aws.amazon.com/cli/latest/reference/guardduty/index.html
  - https://docs.aws.amazon.com/cli/latest/reference/waf/index.html
  - https://www.elastic.co/guide/en/security/current/prebuilt-rules.html
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Steven Dick
Date: 2026-04-15

Description:
The following analytic identifies when a user with sufficient access to Exchange Online alters the mail flow/transport rule configuration of the organization. Transport rules are a set of rules that can be used by attackers to modify or delete emails based on specific conditions, this activity could indicate an attacker hiding or exfiltrated data.

References:
  - https://attack.mitre.org/techniques/T1114/003/
  - https://cardinalops.com/blog/cardinalops-contributes-new-mitre-attck-techniques-related-to-abuse-of-mail-transport-rules/
  - https://www.microsoft.com/en-us/security/blog/2022/09/22/malicious-OAuth-applications-used-to-compromise-email-servers-and-spread-spam/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: experimental
Author: Rod Soto, Splunk
Date: 2026-02-25

Description:
The following analytic identifies unauthenticated requests to Kubernetes cluster pods. It detects this activity by analyzing GCP Pub/Sub messages for audit logs where the response status code is 401, indicating unauthorized access attempts. This activity is significant for a SOC because it may indicate reconnaissance or scanning attempts by an attacker trying to identify vulnerable pods. If confirmed malicious, this activity could lead to unauthorized access, allowing the attacker to exploit vulnerabilities within the cluster, potentially compromising sensitive data or gaining control over the Kubernetes environment.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Dean Luxton
Date: 2026-04-15

Description:
This detection identifies the presence of the default AzureHound user-agent string within Microsoft Graph Activity logs and NonInteractive SignIn Logs. AzureHound is a tool used for gathering information about Azure Active Directory environments, often employed by security professionals for legitimate auditing purposes. However, it can also be leveraged by malicious actors to perform reconnaissance activities, mapping out the Azure AD infrastructure to identify potential vulnerabilities and targets for further exploitation. Detecting its usage can help in identifying unauthorized access attempts and preemptively mitigating potential security threats to your Azure environment.

References:
  - https://github.com/SpecterOps/AzureHound
  - https://splunkbase.splunk.com/app/3110
  - https://splunk.github.io/splunk-add-on-for-microsoft-cloud-services/Install/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Patrick Bareiss, Splunk
Date: 2026-04-15

Description:
The following analytic detects when an EC2 snapshot is shared publicly by analyzing AWS CloudTrail events. This detection method leverages CloudTrail logs to identify modifications in snapshot permissions, specifically when the snapshot is shared outside the originating AWS account. This activity is significant as it may indicate an attempt to exfiltrate sensitive data stored in the snapshot. If confirmed malicious, an attacker could gain unauthorized access to the snapshot's data, potentially leading to data breaches or further exploitation of the compromised information.

References:
  - https://labs.nettitude.com/blog/how-to-exfiltrate-aws-ec2-data/
  - https://stratus-red-team.cloud/attack-techniques/AWS/aws.exfiltration.ec2-share-ebs-snapshot/
  - https://hackingthe.cloud/aws/enumeration/loot_public_ebs_snapshots/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Patrick Bareiss, Splunk
Date: 2026-05-04

Description:
The following analytic detects `PutBucketLifecycle` events in AWS CloudTrail logs where a user sets a lifecycle rule for an S3 bucket with an expiration period of fewer than three days. This detection leverages CloudTrail logs to identify suspicious lifecycle configurations. This activity is significant because attackers may use it to delete CloudTrail logs quickly, thereby evading detection and impairing forensic investigations. If confirmed malicious, this could allow attackers to cover their tracks, making it difficult to trace their actions and respond to the breach effectively.

References:
  - https://stratus-red-team.cloud/attack-techniques/AWS/aws.defense-evasion.cloudtrail-lifecycle-rule/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Bhavin Patel, Splunk
Date: 2026-04-15

Description:
The following analytic detects the creation of an AWS DataSync task, which could indicate potential data exfiltration. It leverages AWS CloudTrail logs to identify the `CreateTask` event from the DataSync service. This activity is significant because attackers can misuse DataSync to transfer sensitive data from a private AWS location to a public one, leading to data compromise. If confirmed malicious, this could result in unauthorized access to sensitive information, causing severe data breaches and compliance violations.

References:
  - https://labs.nettitude.com/blog/how-to-exfiltrate-aws-ec2-data/
  - https://www.shehackske.com/how-to/data-exfiltration-on-cloud-1606/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Bhavin Patel, Patrick Bareiss, Splunk
Date: 2026-05-04

Description:
The following analytic detects the creation of AWS Network Access Control Lists (ACLs) with all ports open to a specified CIDR. It leverages AWS CloudTrail events, specifically monitoring for `CreateNetworkAclEntry` or `ReplaceNetworkAclEntry` actions with rules allowing all traffic. This activity is significant because it can expose the network to unauthorized access, increasing the risk of data breaches and other malicious activities. If confirmed malicious, an attacker could exploit this misconfiguration to gain unrestricted access to the network, potentially leading to data exfiltration, service disruption, or further compromise of the AWS environment.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: experimental
Author: Matthew Moore, Splunk
Date: 2026-03-10

Description:
The following analytic detects anomalous changes in resource utilization ratios for processes running on a Kubernetes node. It leverages process metrics collected via an OTEL collector and hostmetrics receiver, analyzed through Splunk Observability Cloud. The detection uses a lookup table containing average and standard deviation values for various resource ratios (e.g., CPU:memory, CPU:disk operations). Significant deviations from these baselines may indicate compromised processes, malicious activity, or misconfigurations. If confirmed malicious, this could signify a security breach, allowing attackers to manipulate workloads, potentially leading to data exfiltration or service disruption.

References:
  - https://github.com/signalfx/splunk-otel-collector-chart
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Rod Soto, Splunk
Date: 2026-04-15

Description:
The following analytic detects instances where a user has initiated an eDiscovery search or exported a PST file in an Office 365 environment. It leverages Office 365 management activity logs, specifically filtering for events under ThreatManagement with the name "eDiscovery search started or exported." This activity is significant as it may indicate data exfiltration attempts or unauthorized access to sensitive information. If confirmed malicious, it suggests an attacker or insider threat is attempting to gather or exfiltrate data, potentially leading to data breaches, loss of intellectual property, or unauthorized access to confidential communications. Immediate investigation is required.

References:
  - https://attack.mitre.org/techniques/T1114/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Mauricio Velazco, Brian Serocki, Splunk
Date: 2026-04-15

Description:
The following analytic detects the creation of a new Automation Runbook Webhook within an Azure tenant. It leverages Azure Audit events, specifically the "Create or Update an Azure Automation webhook" operation, to identify this activity. This behavior is significant because Webhooks can trigger Automation Runbooks via unauthenticated URLs exposed to the Internet, posing a security risk. If confirmed malicious, an attacker could use this to execute code, create users, or maintain persistence within the environment, potentially leading to unauthorized access and control over Azure resources.

References:
  - https://docs.microsoft.com/en-us/azure/automation/overview
  - https://docs.microsoft.com/en-us/azure/automation/automation-runbook-types
  - https://docs.microsoft.com/en-us/azure/automation/automation-webhooks?tabs=portal
  - https://www.inversecos.com/2021/12/how-to-detect-malicious-azure.html
  - https://www.netspi.com/blog/technical/cloud-penetration-testing/maintaining-azure-persistence-via-automation-accounts/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Patrick Bareiss, Splunk
Date: 2026-04-15

Description:
The following analytic detects when AWS S3 bucket versioning is suspended by a user. It leverages AWS CloudTrail logs to identify `PutBucketVersioning` events with the `VersioningConfiguration.Status` set to `Suspended`. This activity is significant because disabling versioning can prevent recovery of deleted or modified data, which is a common tactic in ransomware attacks. If confirmed malicious, this action could lead to data loss and hinder recovery efforts, severely impacting data integrity and availability.

References:
  - https://invictus-ir.medium.com/ransomware-in-the-cloud-7f14805bbe82
  - https://bleemb.medium.com/data-exfiltration-with-native-aws-s3-features-c94ae4d13436
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Mauricio Velazco, Splunk
Date: 2026-04-15

Description:
The following analytic detects instances where the inbox folder of an Office 365 mailbox is shared with all users within the tenant. It leverages Office 365 management activity events to identify when the 'Inbox' folder permissions are modified to include 'Everyone' with read rights. This activity is significant as it represents a potential security risk, allowing unauthorized access to sensitive emails. If confirmed malicious, this could lead to data breaches, exfiltration of confidential information, and further compromise through spear-phishing or other malicious activities based on the accessed email content.

References:
  - https://attack.mitre.org/techniques/T1114/002/
  - https://www.mandiant.com/sites/default/files/2022-08/remediation-hardening-strategies-for-m365-defend-against-apt29-white-paper.pdf
  - https://www.blackhillsinfosec.com/abusing-exchange-mailbox-permissions-mailsniper/
  - https://learn.microsoft.com/en-us/purview/audit-mailboxes
  - https://learn.microsoft.com/en-us/openspecs/exchange_server_protocols/ms-oxodlgt/5610c6e6-3268-44e3-adff-8804f5315946
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Bhavin Patel, Splunk
Date: 2026-04-15

Description:
The following analytic detects suspicious modifications to AWS AMI attributes, such as sharing an AMI with another AWS account or making it publicly accessible. It leverages AWS CloudTrail logs to identify these changes by monitoring specific API calls. This activity is significant because adversaries can exploit these modifications to exfiltrate sensitive data stored in AWS resources. If confirmed malicious, this could lead to unauthorized access and potential data breaches, compromising the confidentiality and integrity of organizational information.

References:
  - https://labs.nettitude.com/blog/how-to-exfiltrate-aws-ec2-data/
  - https://stratus-red-team.cloud/attack-techniques/AWS/aws.exfiltration.ec2-share-ami/
  - https://hackingthe.cloud/aws/enumeration/loot_public_ebs_snapshots/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
Date: 2026-04-15

Description:
The following analytic detects attempts to disable multi-factor authentication (MFA) for an Azure AD user. It leverages Azure Active Directory AuditLogs to identify the "Disable Strong Authentication" operation. This activity is significant because disabling MFA can allow adversaries to maintain persistence using compromised accounts without raising suspicion. If confirmed malicious, this action could enable attackers to bypass an essential security control, potentially leading to unauthorized access and prolonged undetected presence in the environment.

References:
  - https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-howitworks
  - https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-userstates
  - https://attack.mitre.org/tactics/TA0005/
  - https://attack.mitre.org/techniques/T1556/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Bhavin Patel, Splunk
Date: 2026-04-15

Description:
The following analytic detects a series of AWS API calls related to EC2 snapshots within a short time window, indicating potential exfiltration via EC2 Snapshot modifications. It leverages AWS CloudTrail logs to identify actions such as creating, describing, and modifying snapshot attributes. This activity is significant as it may indicate an attacker attempting to exfiltrate data by sharing EC2 snapshots externally. If confirmed malicious, the attacker could gain access to sensitive information stored in the snapshots, leading to data breaches and potential compliance violations.

References:
  - https://labs.nettitude.com/blog/how-to-exfiltrate-aws-ec2-data/
  - https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifySnapshotAttribute.html
  - https://bleemb.medium.com/data-exfiltration-with-native-aws-s3-features-c94ae4d13436
  - https://stratus-red-team.cloud/attack-techniques/list/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Bhavin Patel, Splunk
Date: 2026-04-15

Description:
The following analytic identifies a spike in the number of AWS Security Hub alerts for an EC2 instance within a 4-hour interval. It leverages AWS Security Hub findings data, calculating the average and standard deviation of alerts to detect anomalies. This activity is significant for a SOC as a sudden increase in alerts may indicate potential security incidents or misconfigurations requiring immediate attention. If confirmed malicious, this could signify an ongoing attack, leading to unauthorized access, data exfiltration, or disruption of services on the affected EC2 instance.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: experimental
Author: Dean Luxton
Date: 2026-02-25

Description:
Microsoft Intune supports deploying packaged applications to support software deployment, this functionality can also be abused for deploying malicious payloads to intune managed devices.
This detection identifies when a new packaged application has been added, updated or deleted.


References:
  - https://posts.specterops.io/death-from-above-lateral-movement-from-azure-to-on-prem-ad-d18cb3959d4d
  - https://securityintelligence.com/x-force/detecting-intune-lateral-movement/
  - https://posts.specterops.io/maestro-9ed71d38d546
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Mauricio Velazco, Splunk
Date: 2026-04-15

Description:
The following analytic identifies authentication events of service principals in Azure Active Directory. It leverages the `azure_monitor_aad` data source, specifically targeting "Sign-in activity" within ServicePrincipalSignInLogs. This detection gathers details such as sign-in frequency, timing, source IPs, and accessed resources. Monitoring these events is significant for SOC teams to distinguish between normal application authentication and potential anomalies, which could indicate compromised credentials or malicious activities. If confirmed malicious, attackers could gain unauthorized access to resources, leading to data breaches or further exploitation within the environment.

References:
  - https://attack.mitre.org/techniques/T1078/004/
  - https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-sign-ins#service-principal-sign-ins
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
Date: 2026-04-15

Description:
The following analytic detects a single source IP failing to authenticate with 30 unique valid users within 5 minutes in Azure Active Directory. It leverages Azure AD SignInLogs with error code 50126, indicating invalid passwords. This behavior is significant as it may indicate a Password Spraying attack, where an adversary attempts to gain initial access or elevate privileges by trying common passwords across many accounts. If confirmed malicious, this activity could lead to unauthorized access, data breaches, or privilege escalation within the Azure AD environment.

References:
  - https://attack.mitre.org/techniques/T1110/003/
  - https://docs.microsoft.com/en-us/security/compass/incident-response-playbook-password-spray
  - https://www.cisa.gov/uscert/ncas/alerts/aa21-008a
  - https://docs.microsoft.com/azure/active-directory/reports-monitoring/reference-sign-ins-error-codes
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Mauricio Velazco, Splunk
Date: 2026-04-15

Description:
The following analytic detects multiple failed multi-factor authentication (MFA) requests for a single user within a Google Cloud Platform (GCP) tenant. It triggers when 10 or more MFA prompts fail within a 5-minute window, using Google Workspace login failure events. This behavior is significant as it may indicate an adversary attempting to bypass MFA by bombarding the user with repeated authentication requests. If confirmed malicious, this activity could lead to unauthorized access, allowing attackers to compromise accounts and potentially escalate privileges within the GCP environment.

References:
  - https://www.mandiant.com/resources/blog/russian-targeting-gov-business
  - https://arstechnica.com/information-technology/2022/03/lapsus-and-solar-winds-hackers-both-use-the-same-old-trick-to-bypass-mfa/
  - https://therecord.media/russian-hackers-bypass-2fa-by-annoying-victims-with-repeated-push-notifications/
  - https://attack.mitre.org/techniques/T1621/
  - https://attack.mitre.org/techniques/T1078/004/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: David Dorsey, Splunk
Date: 2026-04-15

Description:
The following analytic detects the creation of EC2 instances with previously unseen instance types.
It leverages Splunk's tstats command to analyze data from the Change data model, identifying instance types that have not been previously recorded.
This activity is significant for a SOC because it may indicate unauthorized or suspicious activity, such as an attacker attempting to create instances for malicious purposes.
If confirmed malicious, this could lead to unauthorized access, data exfiltration, system compromise, or service disruption. Immediate investigation is required to determine the legitimacy of the instance creation.