deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Bhavin Patel, Splunk
Date: 2026-01-14

Description:
This search establishes, on a per-hour basis, the average and the standard deviation of the number of outbound connections blocked in your VPC flow logs by each source IP address (IP address of your EC2 instances). Also recorded is the number of data points for each source IP. This table outputs to a lookup file to allow the detection search to operate quickly.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: David Dorsey, Splunk
Date: 2026-01-14

Description:
This search is intended to give you a feel for how often successful Windows updates are applied in your environments. Fluctuations in these numbers will allow you to determine when you should be concerned.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: David Dorsey, Splunk
Date: 2026-01-14

Description:
This search builds a table of previously seen images used to launch cloud compute instances
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: David Dorsey, Splunk
Date: 2026-01-14

Description:
This search creates permutations of your existing domains, removes the valid domain names and stores them in a specified lookup file so they can be checked for in the associated detection searches.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: David Dorsey, Splunk
Date: 2026-01-14

Description:
This search counts the numbers of times the system has created remote desktop traffic
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Bhavin Patel, Splunk
Date: 2026-01-14

Description:
This search establishes, on a per-hour basis, the average and the standard deviation for the number of API calls related to security groups made by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Bhavin Patel, Splunk
Date: 2026-01-14

Description:
This search looks for command-line arguments where `cmd.exe /c` is used to execute a program, then creates a baseline of the earliest and latest times we have encountered this command-line argument in our dataset within the last 30 days.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: David Dorsey, Splunk
Date: 2026-01-14

Description:
This search counts the numbers of times the remote desktop process, mstsc.exe, has run on each system.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: David Dorsey, Splunk
Date: 2026-01-14

Description:
This search returns the first and last time a process was seen per endpoint with a parent process of zoom.exe (Windows) or zoom.us (macOS). This table is then cached.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Rico Valdez, Splunk
Date: 2026-01-14

Description:
This search updates a table of previously seen Cloud Instance modifications that have been made by a user
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Bhavin Patel, Splunk
Date: 2026-01-14

Description:
This search looks for successful API activity in CloudTrail within the last 30 days, filters out known users from the identity table, and outputs values of users into `aws_service_accounts.csv` lookup file.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: David Dorsey, Splunk
Date: 2026-01-14

Description:
The search counts the number of times a connection was observed to each destination port, and the number of unique source IPs connecting to them.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Matthew Moore, Splunk
Date: 2026-01-14

Description:
This baseline rule calculates the average and standard deviation of various process resources in a Kubernetes environment. It uses metrics from the Kubernetes API and the Splunk Infrastructure Monitoring Add-on. The rule generates a lookup table with the average and standard deviation of the resource utilization for each process. This baseline can be used to detect anomalies in process resource utilization, which may indicate security threats such as resource exhaustion attacks, cryptojacking, or compromised process behavior.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: David Dorsey, Splunk
Date: 2026-01-14

Description:
This returns the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity within the last day. Cloud provisioning is broadly defined as any event that runs or creates something.  It then updates this information with historical data and filters out locations that have not been seen within the specified time window. This updated table is then cached.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Rico Valdez, Splunk
Date: 2026-01-14

Description:
This search looks for CloudTrail events where a user logs into the console, then creates a baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by username, within the last 30 days.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Bhavin Patel, Splunk
Date: 2026-01-14

Description:
This search shows you every asset category you have and the assets that belong to those categories.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Bhavin Patel, Splunk
Date: 2026-01-14

Description:
This search establishes, on a per-hour basis, the average and standard deviation for the number of API calls related to deleting an S3 bucket by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Bhavin Patel, Splunk
Date: 2026-01-14

Description:
This search looks for successful access to S3 buckets from remote IP addresses, then creates a baseline of the earliest and latest times we have encountered this remote IP within the last 30 days. In this support search, we are only looking for S3 access events where the HTTP response code from AWS is "200"
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Bhavin Patel, Nasreddine Bencherchali, Splunk
Date: 2025-04-29

Description:
Utilize this panel to correlate Snort intrusion events with known threat activity. Configure the Snort-ID-to-Threat lookup to enrich incoming signature data and populate the “Threat Activity by Snort IDs” view.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Michael Haag, Splunk
Date: 2024-05-21

Description:
Utilize this dashboard to assist with auditing and monitoring Windows AppLocker events for your endpoints. Configure the applocker macro to use the AppLocker data source for populating the dashboard.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Steven Dick, Github Community
Date: 2024-08-05

Description:
Utilize this dashboard to assist with auditing and monitoring of Remote Monitoring and Management (RMM) alert content.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Rod Soto, Splunk
Date: 2024-11-14

Description:
This search provides information on Kubernetes accounts accessing sensitve objects such as configmpas or secrets
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Gowthamaraj Rajendran, Bhavin Patel, Splunk
Date: 2026-02-10

Description:
The following analytic detects the execution of the 'apt-get' command with elevated privileges using 'sudo' on a Linux system. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs that include command-line details. This activity is significant because it indicates a user may be attempting to escalate privileges to root, which could lead to unauthorized system control. If confirmed malicious, an attacker could gain root access, allowing them to execute arbitrary commands, install or remove software, and potentially compromise the entire system.

References:
  - https://gtfobins.github.io/gtfobins/apt-get/
  - https://phoenixnap.com/kb/how-to-use-apt-get-commands
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Teoderick Contreras, Splunk
Date: 2025-02-10

Description:
The following analytic has been deprecated in favour of a more generic approach in "Windows Office Product Spawned Uncommon Process". The following analytic detects an Office product spawning a CMD process, which is indicative of a macro executing shell commands to download or run malicious code. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and parent process names. This activity is significant as it often signals the execution of malicious payloads, such as those seen in Trickbot spear-phishing campaigns. If confirmed malicious, this behavior could lead to unauthorized code execution, potentially compromising the system and allowing further malicious activities.

References:
  - https://twitter.com/cyb3rops/status/[PII_REDACTED]70587910?s=21
  - https://bazaar.abuse.ch/sample/02cbc1ab80695fc12ff8822b926957c3a600247b9ca412a137f69cb5716c8781/
  - https://www.fortinet.com/blog/threat-research/latest-remcos-rat-phishing
  - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trojanized-onenote-document-leads-to-formbook-malware/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Michael Haag, Splunk
Date: 2025-02-10

Description:
The following analytic has been deprecated. The following analytic detects the use of `reg.exe` to export Windows Registry hives, which may contain sensitive credentials. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions involving `save` or `export` actions targeting the `sam`, `system`, or `security` hives. This activity is significant as it indicates potential offline credential access attacks, often executed from untrusted processes or scripts. If confirmed malicious, attackers could gain access to credential data, enabling further compromise and lateral movement within the network.

References:
  - https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations
  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md
  - https://media.defense.gov/2023/May/24/[PII_REDACTED]/-1/-1/0/CSA_Living_off_the_Land.PDF
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: David Dorsey, Splunk
Date: 2025-01-16

Description:
This search looks for EC2 instances being created with previously unseen AMIs.  This search is deprecated and have been translated to use the latest Change Datamodel.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: David Dorsey, Splunk
Date: 2024-11-14

Description:
This search gives you the hosts where a backup was attempted and then failed.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Teoderick Contreras, Splunk
Date: 2026-03-16

Description:
The following analytic identifies the execution of the ActiveMicrosoftApp process as a child of Microsoft Excel. Under normal conditions, Excel primarily spawns internal Office-related processes, and the creation of ActiveMicrosoftApp is uncommon in day-to-day business workflows. Adversaries may abuse this behavior to blend malicious activity within trusted applications, execute unauthorized code, or bypass application control mechanisms. This technique aligns with common tradecraft where Office applications are leveraged as initial access or execution vectors due to their prevalence in enterprise environments. Detecting this relationship helps defenders spot suspicious child processes that may indicate malware execution, persistence mechanisms, or attempts to establish command-and-control. Security teams should investigate the parent Excel process, the context of the ActiveMicrosoftApp execution, and any subsequent network or file activity. While certain legitimate Office features could trigger this process in specific environments, its occurrence generally warrants further scrutiny to validate intent and rule out compromise.

References:
  - https://specterops.io/blog/2023/10/30/lateral-movement-abuse-the-power-of-dcom-excel-application/
  - https://blog.talosintelligence.com/pathwiper-targets-ukraine/
  - https://www.trellix.com/blogs/research/dcom-abuse-and-network-erasure-with-trellix-ndr/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Rico Valdez, Splunk
Date: 2026-03-10

Description:
The following analytic identifies spikes in the number of Server Message Block (SMB) connections using the Machine Learning Toolkit (MLTK). It leverages the Network_Traffic data model to monitor SMB traffic on ports 139 and 445, applying a machine learning model to detect anomalies. This activity is significant because sudden increases in SMB traffic can indicate lateral movement or data exfiltration attempts by attackers. If confirmed malicious, this behavior could lead to unauthorized access, data theft, or further compromise of the network.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Peter Gael, Splunk
Date: 2024-11-14

Description:
Enforcing network-access controls is one of the defensive mechanisms used by cloud administrators to restrict access to a cloud instance. After the attacker has gained control of the console by compromising an admin account, they can delete a network ACL and gain access to the instance from anywhere. This search will query the Change datamodel to detect users deleting network ACLs. Deprecated because it's a duplicate
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Bhavin Patel, Splunk
Date: 2024-11-14

Description:
This search looks for command-line arguments that use a `/c` parameter to execute a command that has not previously been seen.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Raven Tait, Splunk
Date: 2025-10-09

Description:
This Splunk query analyzes web access logs to identify and categorize non-browser user agents, detecting various types of security tools, scripting languages, automation frameworks, and suspicious patterns. This activity can signify malicious actors attempting to interact with web endpoints in non-standard ways.

References:
  - https://portswigger.net/web-security/request-smuggling#what-is-http-request-smuggling
  - https://portswigger.net/research/http1-must-die
  - https://www.vaadata.com/blog/what-is-http-request-smuggling-exploitations-and-security-best-practices/
  - https://www.securityweek.com/new-http-request-smuggling-attacks-impacted-cdns-major-orgs-millions-of-websites/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/web/proxy_generic/proxy_ua_hacktool.yml
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Rod Soto, Splunk
Date: 2024-11-14

Description:
This search provides information on Kubernetes RBAC authorizations by accounts, this search can be modified by adding top to see both extremes of RBAC by accounts occurrences
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Rod Soto, Splunk
Date: 2024-11-14

Description:
This search provides information on Kubernetes service accounts with failure or forbidden access status, this search can be extended by using top or rare operators to find trends or rarities in failure status, user agents, source IPs and request URI
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Michael Haag, Rico Valdez, Splunk
Date: 2025-02-10

Description:
**DEPRECATION NOTE** - This search has been deprecated and replaced with `Okta Multiple Accounts Locked Out`. The following anomaly will generate based on account lockout events utilizing Okta eventTypes of user.account.lock.limit or user.account.lock. Per the Okta docs site, this event is fired when a user account has reached the lockout limit. The account will not auto-unlock and a user or client cannot gain access to the account. This event indicates an account that will not be able to log in until remedial action is taken by the account admin. This event can be used to understand the specifics of an account lockout. Often this indicates a client application that is repeatedly attempting to authenticate with invalid credentials such as an old password.

References:
  - https://developer.okta.com/docs/reference/api/event-types/#catalog
  - https://developer.okta.com/docs/reference/api/event-types/?q=user.account.lock
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Rod Soto, Splunk
Date: 2024-11-14

Description:
The following analytic identifies the suspicious use of the AWS STS GetSessionToken API call. It leverages CloudWatch logs to detect instances where this API is invoked, focusing on fields such as source IP address, event time, user identity, and status. This activity is significant because attackers can use these tokens to move laterally within the AWS environment and escalate privileges. If confirmed malicious, this could lead to unauthorized access and control over AWS resources, potentially compromising sensitive data and critical infrastructure.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Rod Soto, Splunk
Date: 2024-11-14

Description:
The following analytic detects the creation of permanent access keys in AWS accounts. It leverages CloudWatch logs to identify events where the `CreateAccessKey` action is performed by IAM users. Monitoring the creation of permanent keys is crucial as they are not created by default and are typically used for programmatic access. If confirmed malicious, this activity could allow attackers to gain persistent access to AWS resources, potentially leading to unauthorized actions and data exfiltration.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Bhavin Patel, Splunk
Date: 2024-11-14

Description:
This search will detect users creating spikes in API activity related to security groups in your AWS environment.  It will also update the cache file that factors in the latest data.  This search is deprecated and have been translated to use the latest Change Datamodel.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Bhavin Patel, Patrick Bareiss, Splunk
Date: 2025-02-10

Description:
This search looks for specific authentication events from the Windows Security Event logs to detect potential attempts at using the Pass-the-Hash technique. This search is DEPRECATED as it is possible for event code 4624 to generate a high level of noise, as legitimate logon events may also trigger this event code. This can be especially true in environments with high levels of user activity, such as those with many concurrent logons or frequent logon attempts.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: David Dorsey, Splunk
Date: 2026-03-10

Description:
The following analytic detects a spike in the number of API calls made to your cloud infrastructure by a user. It leverages cloud infrastructure logs and compares the current API call volume against a baseline probability density function to identify anomalies. This activity is significant because an unusual increase in API calls can indicate potential misuse or compromise of cloud resources. If confirmed malicious, this could lead to unauthorized access, data exfiltration, or disruption of cloud services, posing a significant risk to the organization's cloud environment.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Teoderick Contreras, Splunk
Date: 2025-10-07

Description:
The following analytic detects attempts to modify the Windows Registry to change a network profile's category to "Private", which may indicate an adversary is preparing the environment for lateral movement or reducing firewall restrictions. Specifically, this activity involves changes to the Category value within the HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles\{GUID} registry path. A value of 1 corresponds to a private network profile, which typically enables less restrictive firewall policies. While this action can occur during legitimate network configuration, it may also be a sign of malicious behavior when combined with other indicators such as suspicious account activity, unexpected administrative privilege usage, or execution of unsigned binaries. Monitoring for this registry modification—especially outside standard IT processes or correlated with persistence mechanisms—can help identify stealthy post-exploitation activity.

References:
  - https://www.microsoft.com/en-us/security/blog/2025/07/31/frozen-in-transit-secret-blizzards-aitm-campaign-against-diplomats/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Patrick Bareiss, Splunk
Date: 2025-02-10

Description:
The following analytic detects the disabling of a security workflow in GitHub Actions. It leverages GitHub logs to identify when a workflow, excluding those named *security-testing*, is disabled following a push or pull request event. This activity is significant as it may indicate an attempt by an attacker to conceal malicious code by disabling security checks. If confirmed malicious, this could allow the attacker to introduce and persist undetected malicious code within the repository, potentially compromising the integrity and security of the codebase.

References:
  - https://www.splunk.com/en_us/blog/tips-and-tricks/getting-github-data-with-webhooks.html
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Teoderick Contreras, Splunk
Date: 2025-01-24

Description:
The following analytic has been deprecated. The following analytic identifies a suspicious process command line fetching environment variables with a non-shell parent process. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions and parent process names. This activity is significant as it is commonly associated with malware like Qakbot, which uses this technique to gather system information. If confirmed malicious, this behavior could indicate that the parent process has been compromised, potentially allowing attackers to execute arbitrary commands, escalate privileges, or persist within the environment.

References:
  - https://twitter.com/pr0xylife/status/[PII_REDACTED]41031680?s=46&t=Dc3CJi4AnM-8rNoacLbScg
Sigma Detection Rule: 
Repository: splunk/security_content
Status: removed
Author: Abhinav Mishra, Kumar Sharad and Namratha Sreekanta, Splunk
Date: 2026-03-10

Description:
The following analytic identifies Domain Generation Algorithm (DGA) generated domains using a pre-trained deep learning model. It leverages the Network Resolution data model to analyze domain names and detect unusual character sequences indicative of DGA activity. This behavior is significant as adversaries often use DGAs to generate numerous domain names for command-and-control servers, making it harder to block malicious traffic. If confirmed malicious, this activity could enable attackers to maintain persistent communication with compromised systems, evade detection, and execute further malicious actions.

References:
  - https://attack.mitre.org/techniques/T1568/002/
  - https://unit42.paloaltonetworks.com/threat-brief-understanding-domain-generation-algorithms-dga/
  - https://en.wikipedia.org/wiki/Domain_generation_algorithm