deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2022-08-23

Description:
Leverage searches that allow you to detect and investigate unusual activities that may be related to Brute Ratel Red Teaming tool. This includes creation, modification and deletion of services, collection or data, ping IP, DNS cache, process injection, debug privileges adjustment, winlogon process duplicate token, lock workstation, get clipboard or screenshot and much more.

References:
  - https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/
  - https://www.mdsec.co.uk/2022/08/part-3-how-i-met-your-beacon-brute-ratel/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2025-03-25

Description:
This analytic story addresses critical vulnerabilities in Apache Tomcat that allow attackers to achieve remote code execution through session deserialization attacks. These attacks exploit path equivalence issues in Tomcat's session handling mechanisms, particularly when configured with writable DefaultServlet and file-based session persistence, enabling attackers to upload and execute malicious serialized objects through manipulated session files.

References:
  - https://lists.apache.org/thread/j5fkjv2k477os90nczf2v9l61fb0kkgq
  - https://nvd.nist.gov/vuln/detail/CVE-2025-24813
  - https://github.com/vulhub/vulhub/tree/master/tomcat/CVE-2025-24813
  - https://www.rapid7.com/db/vulnerabilities/apache-tomcat-cve-2025-24813/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Rod Soto, Jose Hernandez, Stan Miskowicz, David Dorsey, Shannon Davis Splunk
Date: 2020-09-18

Description:
Uncover activity related to the execution of Zerologon CVE-2020-11472, a technique wherein attackers target a Microsoft Windows Domain Controller to reset its computer account password. The result from this attack is attackers can now provide themselves high privileges and take over Domain Controller. The included searches in this Analytic Story are designed to identify attempts to reset Domain Controller Computer Account via exploit code remotely or via the use of tool Mimikatz as payload carrier.

References:
  - https://attack.mitre.org/wiki/Technique/T1003
  - https://github.com/SecuraBV/CVE-2020-1472
  - https://www.secura.com/blog/zero-logon
  - https://nvd.nist.gov/vuln/detail/CVE-2020-1472
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Jose Hernandez, Splunk
Date: 2022-05-19

Description:
Monitor for activities and techniques associated with insider threats and specifically focusing on malicious insiders operating with in a corporate environment.

References:
  - https://www.imperva.com/learn/application-security/insider-threats/
  - https://www.cisa.gov/defining-insider-threats
  - https://www.code42.com/glossary/types-of-insider-threats/
  - https://github.com/Insider-Threat/Insider-Threat
  - https://ctid.mitre-engenuity.org/our-work/insider-ttp-kb/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Bhavin Patel, Nasreddine Bencherchali, Splunk
Date: 2025-11-19

Description:
This analytic story provides a suite of detections built to analyze telemetry generated by Cisco Adaptive Security Appliance (ASA) devices.

It focuses on identifying anomalous, suspicious or potentially malicious activity such as logging suppression, unauthorized configuration changes, anomalous connection patterns, unexpected drops in core syslog message volume, and potential command-and-control (C2) behaviors.

These detections help defenders surface behavior on security edge devices that may indicate defense evasion, exploitation attempts, or device tampering.


References:
  - https://www.cisco.com/site/us/en/products/security/firewalls/adaptive-security-appliance-asa-software/index.html
  - https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Bhavin Patel, Splunk
Date: 2017-09-14

Description:
Fortify your data-protection arsenal--while continuing to ensure data confidentiality and integrity--with searches that monitor for and help you investigate possible signs of data exfiltration.

References:
  - https://www.cisecurity.org/controls/data-protection/
  - https://www.sans.org/reading-room/whitepapers/dns/splunk-detect-dns-tunneling-37022
  - https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Mauricio Velazco, Splunk
Date: 2023-04-24

Description:
Monitor for activities and techniques associated with Privilege Escalation attacks within Azure Active Directory tenants.

References:
  - https://attack.mitre.org/tactics/TA0003/
  - https://cloudbrothers.info/en/azure-attack-paths/
  - https://microsoft.github.io/Azure-Threat-Research-Matrix/PrivilegeEscalation/PrivEsc/
  - https://posts.specterops.io/azure-privilege-escalation-via-service-principal-abuse-210ae2be2a5
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2025-12-10

Description:
SesameOp is a Backdoor that abuses the OpenAI Assistants API as its command-and-control (C2) channel. Instead of using a traditional malicious server infrastructure, the malware loads a heavily obfuscated .NET DLL (Netapi64.dll / OpenAIAgent.Netapi64) which reaches out to the Assistants API to fetch encrypted, compressed commands and then executes them on the infected host. Results from these commands are likewise compressed, encrypted and sent back via the same legitimate API channel — effectively hiding malicious traffic in seemingly normal API calls. To evade detection, it injects into the host using .NET AppDomainManager injection, maintains persistence over time, and obfuscates communications via symmetric and asymmetric encryption plus compression.

References:
  - https://www.microsoft.com/en-us/security/blog/2025/11/03/sesameop-novel-backdoor-uses-openai-assistants-api-for-command-and-control/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Rod Soto, Splunk
Date: 2025-09-24

Description:
Leverage advanced Splunk searches to detect and investigate suspicious activities targeting Microsoft 365 Copilot, including prompt injection attacks, agentic jailbreaks, information extraction attempts, compliance violations, and anomalous user behaviors.

References:
  - https://www.splunk.com/en_us/blog/artificial-intelligence/m365-copilot-log-analysis-splunk.html
  - https://labs.zenity.io/p/a-copilot-studio-story-2-when-aijacking-leads-to-full-data-exfiltration-bc4a
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2024-01-29

Description:
This analytic story provides a comprehensive view of Jenkins server vulnerabilities and associated detection analytics.

References:
  - https://www.jenkins.io/security/advisory/2024-01-24/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Matthew Moore, Patrick Bareiss, Splunk
Date: 2024-01-08

Description:
Kubernetes, a complex container orchestration system, is susceptible to a variety of security threats. This story delves into the different strategies and methods adversaries employ to exploit Kubernetes environments. These include attacks on the control plane, exploitation of misconfigurations, and breaches of containerized applications. Observability data, such as metrics, play a crucial role in identifying abnormal and potentially malicious behavior within these environments.

References:
  - https://kubernetes.io/docs/concepts/security/
  - https://splunkbase.splunk.com/app/5247
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, AJ King, Splunk
Date: 2025-03-24

Description:
This story addresses a critical Windows shortcut zero-day vulnerability (ZDI-CAN-25373) that has been actively exploited in widespread APT campaigns. The vulnerability allows attackers to execute malicious code through specially crafted LNK files, which can be delivered via both HTTP and SMB protocols. This exploit has been observed being used by multiple threat actors in targeted attacks.

References:
  - https://www.zerodayinitiative.com/advisories/ZDI-25-373/
  - https://www.trendmicro.com/en_us/research/25/c/windows-shortcut-zero-day-exploit.html
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: David Dorsey, Mauricio Velazco Splunk
Date: 2021-12-09

Description:
Detect and investigate tactics, techniques, and procedures around how attackers move laterally within an Active Directory environment. Since lateral movement is often a necessary step in a breach, it is important for cyber defenders to deploy detection coverage.

References:
  - https://www.fireeye.com/blog/executive-perspective/2015/08/malware_lateral_move.html
  - http://www.irongeek.com/i.php?page=videos/derbycon7/t405-hunting-lateral-movement-for-fun-and-profit-mauricio-velazco
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Jose Hernandez
Date: 2021-12-11

Description:
Log4Shell or CVE-2021-44228 is a Remote Code Execution (RCE) vulnerability in the Apache Log4j library, a widely used and ubiquitous logging framework for Java. The vulnerability allows an attacker who can control log messages to execute arbitrary code loaded from attacker-controlled servers and we anticipate that most apps using the Log4j library will meet this condition.

References:
  - https://mbechler.github.io/2021/12/10/PSA_Log4Shell_JNDI_Injection/
  - https://www.fastly.com/blog/digging-deeper-into-log4shell-0day-rce-exploit-found-in-log4j
  - https://www.crowdstrike.com/blog/log4j2-vulnerability-analysis-and-mitigation-recommendations/
  - https://www.lunasec.io/docs/blog/log4j-zero-day/
  - https://www.splunk.com/en_us/blog/security/log-jammin-log4j-2-rce.html
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Rico Valdez, Splunk
Date: 2018-10-23

Description:
Attackers are increasingly abusing Windows Management Instrumentation (WMI), a framework and associated utilities available on all modern Windows operating systems. Because WMI can be leveraged to manage both local and remote systems, it is important to identify the processes executed and the user context within which the activity occurred.

References:
  - https://www.blackhat.com/docs/us-15/materials/us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent%20Asynchronous-And-Fileless-Backdoor-wp.pdf
  - https://web.archive.org/web/[PII_REDACTED]1529/https://www.fireeye.com/blog/threat-research/2017/03/wmimplant_a_wmi_ba.html
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Rod Soto, Splunk
Date: 2022-03-25

Description:
Double Zero Destructor is a destructive payload that enumerates Domain Controllers and executes killswitch if detected. Overwrites files with Zero blocks or using MS Windows API calls such as NtFileOpen, NtFSControlFile. This payload also deletes registry hives HKCU,HKLM, HKU, HKLM BCD.

References:
  - https://cert.gov.ua/article/38088
  - https://blog.talosintelligence.com/2022/03/threat-advisory-doublezero.html
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Lou Stella, Splunk
Date: 2022-03-16

Description:
Leverage analytics that allow you to identify the presence of an adversary leveraging native applications within your environment.

References:
  - https://lolbas-project.github.io/
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss
Date: 2021-12-21

Description:
This configuration file applies to all detections of type anomaly. These detections will use Risk Based Alerting.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss
Date: 2021-12-21

Description:
This configuration file applies to all detections of type Correlation. These correlations will generate Notable Events.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss
Date: 2021-12-21

Description:
This configuration file applies to all detections of type hunting.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss
Date: 2021-12-21

Description:
This configuration file applies to all detections of type TTP. These detections will use Risk Based Alerting and generate Notable Events.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss
Date: 2021-12-21

Description:
This configuration file applies to all detections of type baseline.
Metasploit Module: Sample Exploit
Type: exploit
Path: modules/exploits/example.rb
Platform: win
Disclosure date: 2020-12-30
Authors: skape
References: OSVDB-12345, EDB-12345, URL-http://www.example.com, CVE-1978-1234

Description:
This exploit module illustrates how a vulnerability could be exploited
          in an TCP server that has a parsing bug.

Check method (fingerprinting):
CheckCode::Vulnerable('Target is always considered vulnerable')
  end

  #
  # The exploit method connects to the remote service and sends 1024 random bytes
  # followed by the fake return address and then the payload.
  #
Metasploit Module: Sample Webapp Exploit
Type: exploit
Path: modules/exploits/example_webapp.rb
Platform: python
Disclosure date: 2023-12-30
References: OSVDB-12345, EDB-12345, URL-http://www.example.com, CVE-1978-1234

Description:
This exploit module illustrates how a vulnerability could be exploited
          in a webapp.

Check method (fingerprinting):
# only catch the response if we're going to use it, in this case we do for the version
    # detection.
    res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path, 'index.php'),
      'method' => 'GET'
    )
    # gracefully handle if res comes back as nil, since we're not guaranteed a response
    # also handle if we get an unexpected HTTP response code
    return CheckCode::Unknown("#{peer} - Could not connect to web service - no response") if res.nil?
    return CheckCode::Unknown("#{peer} - Check URI Path, unexpected HTTP response code: #{res.code}") if res.code == 200

    # here we're looking through html for the version string, similar to:
    # Version 1.2
    %r{Version: (?<version>\d{1,2}\.\d{1,2})</td>} =~ res.body

    if version && Rex::Version.new(version) <= Rex::Version.new('1.3')
      CheckCode::Appears("Version Detected: #{version}")
    end

    CheckCode::Safe('Target does not appear to be vulnerable')
  end

  #
  # The exploit method attempts a login, then attempts to throw a command execution
  # at a web page through a POST variable
  #
Metasploit Module: Sample Linux Priv Esc
Type: exploit
Path: modules/exploits/example_linux_priv_esc.rb
Disclosure date: 2023-11-29
References: OSVDB-12345, EDB-12345, URL-http://www.example.com, CVE-1978-1234

Description:
This exploit module illustrates how a vulnerability could be exploited
          in an linux command for priv esc.

Check method (fingerprinting):
# Check the kernel version to see if its in a vulnerable range
    # we guard this because some distros have funky kernel versions https://github.com/rapid7/metasploit-framework/issues/19812
    release = kernel_release
    begin
      if Rex::Version.new(release.split('-').first) > Rex::Version.new('4.14.11') ||
         Rex::Version.new(release.split('-').first) < Rex::Version.new('4.0')
        return CheckCode::Safe("Kernel version #{release} is not vulnerable")
      end
    rescue ArgumentError => e
      return CheckCode::Safe("Error determining or processing kernel release (#{release}) into known format: #{e}")
    end
    vprint_good "Kernel version #{release} appears to be vulnerable"

    # Check the app is installed and the version, debian based example
    package = cmd_exec('dpkg -l example | grep \'^ii\'')
    if package&.include?('1:2015.3.14AR.1-1build1')
      return CheckCode::Appears("Vulnerable app version #{package} detected")
    end

    CheckCode::Safe("app #{package} is not vulnerable")
  end

  #
  # The exploit method drops a payload file to the system, then either compiles and runs
  # or just runs the exploit on the system.
  #
Metasploit Module: Sample Linux Persistence
Type: exploit
Path: modules/exploits/example_linux_persistence.rb
Disclosure date: 2023-11-29
References: OSVDB-12345, EDB-12345, URL-http://www.example.com, CVE-1978-1234

Description:
This exploit sample shows how a persistence module could be written
          for a linux computer.

Check method (fingerprinting):
# Check a example app is installed
    print_warning('Payloads in /tmp will only last until reboot, you may want to choose elsewhere.') if writable_dir.start_with?('/tmp')
    return CheckCode::Safe("#{writable_dir} doesnt exist") unless exists?(writable_dir)
    return CheckCode::Safe("#{writable_dir} isnt writable") unless writable?(writable_dir)
    return CheckCode::Safe('example app is required') unless command_exists?('example')

    CheckCode::Detected('example app is installed')
  end

  #
  # The install_persistence method installs the persistence, starts the handler, and does all
  # the main activities
  #
Metasploit Module: Generic Payload Handler
Type: exploit
Path: modules/exploits/multi/handler.rb
Platform: %w[android apple_ios bsd java js linux osx nodejs php python ruby solaris unix win mainframe multi

Description:
This module is a stub that provides all of the
          features of the Metasploit payload system to exploits
          that have been launched outside of the framework.
Metasploit Module: VNC Keyboard Remote Code Execution
Type: exploit
Path: modules/exploits/multi/vnc/vnc_keyboard_exec.rb
Platform: win
Disclosure date: 2015-07-10
References: URL-http://www.jedi.be/blog/2010/08/29/sending-keystrokes-to-your-virtual-machines-using-X-vnc-rdp-or-native/
Targets: VNC Windows / Powershell, VNC Linux / Unix

Description:
This module exploits VNC servers by sending virtual keyboard keys and executing
          a payload. On Windows systems a command prompt is opened and a PowerShell or CMDStager
          payload is typed and executed. On Unix/Linux systems a xterm terminal is opened
          and a payload is typed and executed.
Metasploit Module: Wyse Rapport Hagent Fake Hserver Command Execution
Type: exploit
Path: modules/exploits/multi/wyse/hagent_untrusted_hsdata.rb
Platform: win
Disclosure date: 2009-07-10
Authors: kf
References: CVE-2009-0695, OSVDB-55839, US-CERT-VU-654545, URL-http://snosoft.blogspot.com/, URL-http://www.theregister.co.uk/2009/07/10/wyse_remote_exploit_bugs/

Description:
This module exploits the Wyse Rapport Hagent service by pretending to
          be a legitimate server. This process involves starting both HTTP and
          FTP services on the attacker side, then contacting the Hagent service of
          the target and indicating that an update is available. The target will
          then download the payload wrapped in an executable from the FTP service.
Metasploit Module: MagniComp SysInfo mcsiwrapper Privilege Escalation
Type: exploit
Path: modules/exploits/multi/local/magnicomp_sysinfo_mcsiwrapper_priv_esc.rb
Platform: solaris
Disclosure date: 2016-09-23
References: CVE-2017-6516, BID-96934, URL-http://www.magnicomp.com/support/cve/CVE-2017-6516.shtml, URL-https://labs.mwrinfosecurity.com/advisories/magnicomps-sysinfo-root-setuid-local-privilege-escalation-vulnerability/, URL-https://labs.mwrinfosecurity.com/advisories/multiple-vulnerabilities-in-magnicomps-sysinfo-root-setuid/
Targets: Solaris, Linux

Description:
This module attempts to gain root privileges on systems running
          MagniComp SysInfo versions prior to 10-H64.

          The .mcsiwrapper suid executable allows loading a config file using the
          '--configfile' argument. The 'ExecPath' config directive is used to set
          the executable load path. This module abuses this functionality to set
          the load path resulting in execution of arbitrary code as root.

          This module has been tested successfully with SysInfo version
          10-H63 on Fedora 20 x86_64, 10-H32 on Fedora 27 x86_64, 10-H10 on
          Debian 8 x86_64, and 10-GA on Solaris 10u11 x86.

Check method (fingerprinting):
return CheckCode::Safe("Directory '#{sysinfo_dir}' does not exist") unless directory?(sysinfo_dir)

    vprint_good "Directory '#{sysinfo_dir}' exists"

    mcsiwrapper_path = "#{sysinfo_dir}/bin/.mcsiwrapper"
    return CheckCode::Safe("#{mcsiwrapper_path} is not setuid") unless setuid?(mcsiwrapper_path)

    vprint_good("#{mcsiwrapper_path} is setuid")

    bash_path = cmd_exec('which bash')
    return CheckCode::Safe('bash is not installed. Exploitation will fail.') unless bash_path.start_with?('/') && bash_path.include?('bash')

    vprint_good('bash is installed')

    config_version = cmd_exec("grep ProdVersion= #{sysinfo_dir}/config/mcsysinfo.cfg")
    version = config_version.scan(/^ProdVersion=(\d+-H\d+|\d+-GA)$/).flatten.first
    return CheckCode::Detected('Could not determine the SysInfo version') if version.blank?
    return CheckCode::Safe("SysInfo version #{version} is not vulnerable") if Rex::Version.new(version.sub('-H', '.')) >= Rex::Version.new('10.64')

    CheckCode::Appears("SysInfo version #{version} is vulnerable")
  end
Metasploit Module: Allwinner 3.4 Legacy Kernel Local Privilege Escalation
Type: exploit
Path: modules/exploits/multi/local/allwinner_backdoor.rb
Disclosure date: 2016-04-30
References: CVE-2016-10225, URL-http://forum.armbian.com/index.php/topic/1108-security-alert-for-allwinner-sun8i-h3a83th8/, URL-https://webcache.googleusercontent.com/search?q=cache:l2QYVUcDflkJ:, URL-http://irclog.whitequark.org/linux-sunxi/2016-04-29#16314390

Description:
This module attempts to exploit a debug backdoor privilege escalation in
          Allwinner SoC based devices.

          Vulnerable Allwinner SoC chips: H3, A83T or H8 which rely on Kernel 3.4.

          Vulnerable OS: all OS images available for Orange Pis,
          any for FriendlyARM's NanoPi M1,
          SinoVoip's M2+ and M3,
          Cuebietech's Cubietruck +
          Linksprite's pcDuino8 Uno.
          Exploitation may be possible against Dragon (x10) and Allwinner Android tablets.

Check method (fingerprinting):
backdoor = '/proc/sunxi_debug/sunxi_debug'

    if file_exist?(backdoor)
      return CheckCode::Appears("#{backdoor} exists")
    end

    CheckCode::Safe("Backdoor #{backdoor} not found")
  end