deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: 
Repository: splunk/security_content

Description:
A regex used with match statements preloaded with generic suspicious terms or phrases. Is used to detect malicious actor or insider threat searches, replace/modify these terms to suit your organization.
Sigma Detection Rule: 
Repository: splunk/security_content

Description:
This macro is a placeholder that contains a list of important audit policy sub categories. By default it only monitors the "Audit Audit Policy Change", "Audit Logon" and "Audit Process Creation" sub categories. Customer should modify this macro and add the GUIDs important to them.
Sigma Detection Rule: 
Repository: splunk/security_content

Description:
Use this macro to determine how long to keep track of cloud provisioning locations
Sigma Detection Rule: 
Repository: splunk/security_content

Description:
Define your user agents which are allowed to connect to your kubernetes cluster.
Sigma Detection Rule: 
Repository: splunk/security_content

Description:
customer specific splunk configurations(eg- index, source, sourcetype) for Cisco Network Visibility Module flow logs. Replace the macro definition with configurations for your Splunk Environment.
Sigma Detection Rule: 
Repository: splunk/security_content

Description:
Use this macro to determine how long to keep track of cloud instance types
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2022-06-03

Description:
On June 2, security researchers at Volexity published a blog outlining the discovery of an unauthenticated remote code execution zero day vulnerability (CVE-2022-26134) being actively exploited in Atlassian Confluence Server and Data Center instances in the wild. Atlassian released a fix within 24 hours of the blog''s release.

References:
  - https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02[PII_REDACTED].html
  - https://www.splunk.com/en_us/blog/security/atlassian-confluence-vulnerability-cve-2022-26134.html
  - https://www.rapid7.com/blog/post/2022/06/02/active-exploitation-of-confluence-cve-2022-26134/
  - https://www.volexity.com/blog/2022/06/02/zero-day-exploitation-of-atlassian-confluence/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Bhavin Patel, Splunk
Date: 2024-12-05

Description:
This analytic story contains detections that query your AWS CloudTrail and CloudWatch logs for activities related to potential security risks and malicious activities on Amazon Bedrock services.

References:
  - https://www.sumologic.com/blog/defenders-guide-to-aws-bedrock/
  - https://www.mitigant.io/en/blog/bedrock-or-bedsand-attacking-amazon-bedrocks-achilles-heel
  - https://sysdig.com/blog/llmjacking-targets-deepseek/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2026-01-12

Description:
These behaviors associated with browser hijacking techniques where malware manipulates browser configurations, preferences, or registry settings to alter browsing behavior, disable updates, and install unauthorized extensions. Modern hijackers may directly modify Chrome preference files, use automation to inject unwanted content, or change policy settings (including allowlisting extensions) to persist and evade standard protections. These actions often result in unwanted redirects, malicious extension loading, or persistent policy tampering that can compromise user browsing integrity and system security. Detecting such modifications helps identify potential hijacker activity early and supports incident response efforts.

References:
  - https://www.gdatasoftware.com/blog/2025/11/38298-learning-about-browser-hijacking
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Rod Soto, Splunk
Date: 2021-01-26

Description:
This analytical story addresses events that indicate abuse of cloud federated credentials. These credentials are usually extracted from endpoint desktop or servers specially those servers that provide federation services such as Windows Active Directory Federation Services. Identity Federation relies on objects such as Oauth2 tokens, cookies or SAML assertions in order to provide seamless access between cloud and perimeter environments. If these objects are either hijacked or forged then attackers will be able to pivot into victim's cloud environements.

References:
  - https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
  - https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf
  - https://us-cert.cisa.gov/ncas/alerts/aa21-008a
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Mauricio Velazco, Patrick Bareiss, Splunk
Date: 2023-10-17

Description:
Monitor for activities and anomalies indicative of initial access techniques within Office 365 environments.

References:
  - https://docs.microsoft.com/en-us/security/compass/incident-response-playbook-password-spray
  - https://www.cisa.gov/uscert/ncas/alerts/aa21-008a
  - https://docs.microsoft.com/azure/active-directory/reports-monitoring/reference-sign-ins-error-codes
  - https://attack.mitre.org/tactics/TA0001/
  - https://stealthbits.com/blog/bypassing-mfa-with-pass-the-cookie/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Mauricio Velazco, Splunk
Date: 2024-02-12

Description:
Monitor for activities and anomalies indicative of potential collection techniques within Office 365 environments.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2023-05-03

Description:
Adversaries may use bootkits to persist on systems. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.

References:
  - https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/
  - https://www.welivesecurity.com/2023/03/01/blacklotus-uefi-bootkit-myth-confirmed/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2024-07-30

Description:
This analytic story addresses the VMware ESXi Active Directory Integration Authentication Bypass vulnerability (CVE-2024-37085). It detects attempts to exploit this flaw, which allows attackers with sufficient AD permissions to gain full access to ESXi hosts by recreating the 'ESX Admins' group after deletion.

References:
  - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24505
  - https://www.microsoft.com/en-us/security/blog/2024/07/29/ransomware-operators-exploit-esxi-hypervisor-vulnerability-for-mass-encryption/
  - https://www.securityweek.com/microsoft-says-ransomware-gangs-exploiting-just-patched-vmware-esxi-flaw/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Nasreddine Bencherchali, Splunk
Date: 2025-12-08

Description:
This analytic story covers the detection content to React2Shell (CVE-2025-55182), a critical pre-authentication Remote Code Execution (RCE) vulnerability in React Server Components.


References:
  - https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components
  - https://nextjs.org/blog/CVE-2025-66478
  - https://nvd.nist.gov/vuln/detail/CVE-2025-55182
  - https://gist.github.com/maple3142/48bc9393f45e068cf8c90ab865c0f5f3
  - https://www.wiz.io/blog/critical-vulnerability-in-react-cve-2025-55182
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Shannon Davis, Splunk
Date: 2021-01-27

Description:
Uncover activity consistent with CVE-2021-3156. Discovered by the Qualys Research Team, this vulnerability has been found to affect sudo across multiple Linux distributions (Ubuntu 20.04 and prior, Debian 10 and prior, Fedora 33 and prior). As this vulnerability was committed to code in July 2011, there will be many distributions affected. Successful exploitation of this vulnerability allows any unprivileged user to gain root privileges on the vulnerable host.

References:
  - https://blog.qualys.com/vulnerabilities-research/2021/01/26/cve-2021-3156-heap-based-buffer-overflow-in-sudo-baron-samedit
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Bhavin Patel, Splunk
Date: 2026-02-25

Description:
This analytic story provides a suite of detections built to analyze network and access logs from Cisco Secure Access.
The included analytics focus on uncovering suspicious and potentially malicious behavior such as unauthorized access attempts, anomalous authentication patterns, policy violations, and indicators of compromised credentials.
These detections help security teams identify threats that may bypass traditional perimeter defenses, offering deeper insight into user access behavior, device posture anomalies, and adversary abuse of legitimate access pathways.


References:
  - https://www.cisco.com/site/us/en/products/security/secure-access/index.html
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2023-07-11

Description:
CVE-2023-36884 is an unpatched zero-day vulnerability affecting Windows and Microsoft Office products. The vulnerability allows for remote code execution through specially crafted Microsoft Office documents, enabling an attacker to operate in the context of the victim. As of now, there are no security updates available. However, users of Microsoft Defender for Office and the "Block all Office applications from creating child processes" Attack Surface Reduction Rule are safeguarded against this exploit. For other users, temporary mitigation can be achieved by adding specific application names to a designated registry key.

References:
  - https://gist.github.com/MHaggis/22ad[PII_REDACTED]e70ce0b873e98b2d0
  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36884
  - https://www.bleepingcomputer.com/news/microsoft/microsoft-july-2023-patch-tuesday-warns-of-6-zero-days-132-flaws/
  - https://www.microsoft.com/en-us/security/blog/2023/07/11/storm-0978-attacks-reveal-financial-and-espionage-motives/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2023-05-25

Description:
This analytic story contains detections that allow security analysts to detect and investigate unusual activities that might relate to the "Volt Typhoon" group targeting critical infrastructure organizations in United States and Guam. The affected organizations include the communications, manufacturing, utility, transportation, construction, maritime, government, information technology, and education sectors. This Analytic story looks for suspicious process execution, lolbin execution, command-line activity, lsass dump and many more.

References:
  - https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Bhavin Patel, Splunk
Date: 2024-09-24

Description:
Detect rarely used executables, specific registry paths that may confer malware survivability and persistence, instances where cmd.exe is used to launch script interpreters, and other indicators that the Emotet financial malware has compromised your environment.

References:
  - https://www.us-cert.gov/ncas/alerts/TA18-201A
  - https://www.first.org/resources/papers/conf2017/Advanced-Incident-Detection-and-Threat-Hunting-using-Sysmon-and-Splunk.pdf
  - https://www.vkremez.com/2017/05/emotet-banking-trojan-malware-analysis.html
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2022-11-21

Description:
The following analytic story highlights content related directly to MetaSploit, which may be default configurations attributed to MetaSploit or behaviors of known knowns that are related.

References:
  - https://github.com/rapid7/metasploit-framework
  - https://www.varonis.com/blog/what-is-metasploit
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2025-05-06

Description:
Leverage searches that allow you to detect and investigate unusual activities that might relate to the presence of the XWorm remote access trojan (RAT). XWorm is a sophisticated and stealthy malware variant often used in data theft operations. Its capabilities include keylogging, screen capturing, remote desktop control, and data exfiltration, all of which can operate undetected. By utilizing advanced search queries and behavioral analytics, you can uncover anomalies such as unauthorized remote connections, unusual process behavior, or unexpected outbound traffic patterns. These indicators often signal the early stages of compromise, enabling rapid response before significant damage occurs. Implementing detection rules and correlating threat intelligence with system logs further enhances your ability to pinpoint XWorm activity.

References:
  - https://malpedia.caad.fkie.fraunhofer.de/details/win.xworm
  - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/proton66-part-2-compromised-wordpress-pages-and-malware-campaigns/
  - https://sarviyamalwareanalyst.medium.com/xworm-attack-chain-leveraging-steganography-from-phishing-email-to-keylogging-via-c2-communication-f3a4c91dfd06
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2022-09-15

Description:
The Iranian government-sponsored APT actors are actively targeting a broad range of victims across multiple U.S. critical infrastructure sectors, including the Transportation Sector and the Healthcare and Public Health Sector, as well as Australian organizations.

References:
  - https://www.cisa.gov/uscert/ncas/alerts/aa21-321a
  - https://www.cisa.gov/uscert/ncas/alerts/aa22-257a
  - https://www.ic3.gov/Media/News/2021/210527.pdf
  - https://www.us-cert.gov/sites/default/files/AA22-257A.stix.xml
  - https://www.us-cert.cisa.gov/iran
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2025-02-28

Description:
Leverage searches for Dropped Files anomalies,  and registry modification to detect SystemBC malware. This threat acts as a backdoor proxy that enables attackers to maintain persistence, evade detection, and facilitate ransomware operations. It often uses SOCKS5 proxies to disguise malicious traffic, making traditional network monitoring less effective. Look for unusual outbound connections, especially to known threat actor infrastructure. Additionally, analyze PowerShell scripts, scheduled tasks, and process injections that may indicate SystemBC deployment. Proactive threat hunting and endpoint monitoring are essential to detecting and mitigating this malware.

References:
  - https://malpedia.caad.fkie.fraunhofer.de/details/win.systembc
  - https://thedfirreport.com/2025/01/27/cobalt-strike-and-a-pair-of-socks-lead-to-lockbit-ransomware/
  - https://hackread.com/systembc-rat-targets-linux-ransomware-infostealers/
  - https://hackread.com/infostealers-breach-us-security-military-fbi-hit/
  - https://www.kroll.com/en/insights/publications/cyber/inside-the-systembc-malware-server
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Mauricio Velazco, Bhavin Patel, Splunk
Date: 2022-10-12

Description:
Monitor for activities and techniques associated with Account Takeover attacks against Google Cloud Platform tenants.

References:
  - https://cloud.google.com/gcp
  - https://cloud.google.com/architecture/identity/overview-google-authentication
  - https://attack.mitre.org/techniques/T1586/
  - https://www.imperva.com/learn/application-security/account-takeover-ato/
  - https://www.barracuda.com/glossary/account-takeover
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Patrick Bareiss
Date: 2023-12-06

Description:
Kubernetes, as a container orchestration platform, faces unique security challenges. This story explores various tactics and techniques adversaries use to exploit Kubernetes environments, including attacking the control plane, exploiting misconfigurations, and compromising containerized applications.

References:
  - https://kubernetes.io/docs/concepts/security/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Patrick Bareiss, Splunk
Date: 2024-07-08

Description:
This analytics story focuses on identifying suspicious activities and potential account compromise events within environments protected by Duo multi-factor authentication (MFA). It provides detection rules and guidance to help security teams recognize signs of adversary tactics such as bypassing MFA, unauthorized access attempts, and other behaviors indicative of account takeover or credential abuse.

References:
  - https://attack.mitre.org/techniques/T1586/
  - https://www.imperva.com/learn/application-security/account-takeover-ato/
  - https://www.barracuda.com/glossary/account-takeover
  - https://www.okta.com/customer-identity/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2021-03-24

Description:
Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the Command And Control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP.

References:
  - https://attack.mitre.org/techniques/T1105/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Mauricio Velazco, Splunk
Date: 2021-08-20

Description:
Monitor for activities and techniques associated with Discovery and Reconnaissance within with Active Directory environments.

References:
  - https://attack.mitre.org/tactics/TA0007/
  - https://adsecurity.org/?p=2535
  - https://attack.mitre.org/techniques/T1087/001/
  - https://attack.mitre.org/techniques/T1087/002/
  - https://attack.mitre.org/techniques/T1087/003/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2025-04-17

Description:
This analytic story contains detections for techniques used by the Water Gamayun threat actor, which targets telecommunications and financial sectors. The group employs various techniques including MSC EvilTwin exploitation, custom backdoors, information stealers, and sophisticated reconnaissance methods.

References:
  - https://securityintelligence.com/posts/new-threat-actor-water-gamayun-targets-telecom-finance/
  - https://www.ncsc.gov.uk/report/weekly-threat-report-12th-april-2024
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Bhavin Patel, Splunk
Date: 2023-04-24

Description:
Use the searches in this Analytic Story using Cloudtrail logs to to monitor your AWS S3 buckets for evidence of anomalous activity and suspicious behaviors, such as detecting open S3 buckets and buckets being accessed from a new IP, permission and policy updates to the bucket, potential misuse of other services leading to data being leaked.

References:
  - https://github.com/nagwww/s3-leaks
  - https://www.tripwire.com/state-of-security/security-data-protection/cloud/public-aws-s3-buckets-writable/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2025-12-15

Description:
StealC is a lightweight information-stealing malware primarily focused on harvesting browser-stored data. It targets popular browsers such as Chrome, Edge, Firefox, and Chromium-based variants to extract saved credentials, cookies, autofill data, browsing history, and session tokens. StealC abuses browser SQLite databases and encryption APIs to decrypt stored passwords, enabling account takeover and further compromise. The malware often runs silently in user context, evading detection through minimal footprint, obfuscation, and rapid data exfiltration to command-and-control servers. Detection typically involves monitoring unauthorized access to browser profile directories, suspicious process behavior interacting with browser credential stores, and outbound network traffic to known StealC infrastructure.

References:
  - https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Mauricio Velazco, Patrick Bareiss, Splunk
Date: 2023-10-17

Description:
Monitor for activities and anomalies indicative of potential persistence techniques within Office 365 environments.

References:
  - https://attack.mitre.org/tactics/TA0003/
  - https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf
  - https://www.cisa.gov/uscert/ncas/alerts/aa21-008a
  - https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html
  - https://blog.sygnia.co/detection-and-hunting-of-golden-saml-attack?hsLang=en
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2022-10-05

Description:
From November 2021 through January 2022, the Cybersecurity and Infrastructure Security Agency (CISA) responded to advanced persistent threat (APT) activity on a Defense Industrial Base (DIB) Sector organization's enterprise network. During incident response activities, multiple utilities were utilized.

References:
  - https://www.cisa.gov/uscert/ncas/alerts/aa22-277a
  - https://www.cisa.gov/uscert/sites/default/files/publications/aa22-277a-impacket-and-exfiltration-tool-used-to-steal-sensitive-information-from-defense-industrial-base-organization.pdf
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Rico Valdez, Splunk
Date: 2024-09-24

Description:
Monitor your cloud authentication events. Searches within this Analytic Story leverage the recent cloud updates to the Authentication data model to help you stay aware of and investigate suspicious login activity.

References:
  - https://aws.amazon.com/blogs/security/aws-cloudtrail-now-tracks-cross-account-activity-to-its-origin/
  - https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: David Dorsey, Splunk
Date: 2020-04-13

Description:
Attackers are using Zoom as an vector to increase privileges on a sytems. This story detects new child processes of zoom and provides investigative actions for this detection.

References:
  - https://blog.rapid7.com/2020/04/02/dispelling-zoom-bugbears-what-you-need-to-know-about-the-latest-zoom-vulnerabilities/
  - https://threatpost.com/two-zoom-zero-day-flaws-uncovered/154337/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Bhavin Patel, Splunk
Date: 2018-05-21

Description:
Monitor your AWS network infrastructure for bad configurations and malicious activity. Investigative searches help you probe deeper, when the facts warrant it.

References:
  - https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Appendix_NACLs.html
  - https://aws.amazon.com/blogs/security/how-to-help-prepare-for-ddos-attacks-by-reducing-your-attack-surface/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2021-02-03

Description:
Monitor and detect techniques used by attackers who leverage rundll32.exe to execute arbitrary malicious code.

References:
  - https://attack.mitre.org/techniques/T1218/011/
  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.011/T1218.011.md
  - https://lolbas-project.github.io/lolbas/Binaries/Rundll32