deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: New RDP Connection Initiated From Domain Controller
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Josh Nickels
Date: 2024-05-10
ATT&CK techniques: T1021
Log source: windows/network_connection

Description:
Detects an RDP connection originating from a domain controller.

Detection logic:
{
  "selection_connection": {
    "Initiated": "True",
    "DestinationPort": 3389
  },
  "selection_hosts": {
    "Computer|expand": "%domain_controller_hostnames%"
  },
  "filter_optional_defender_identity": {
    "Image|endswith": "\\Microsoft.Tri.Sensor.exe"
  },
  "condition": "all of selection_* and not 1 of filter_*"
}

References:
  - Internal Research
Sigma Detection Rule: New MsDS-DelegatedManagedServiceAccount (DMSA) Object Created
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-05-24
ATT&CK techniques: T1078.002, T1098
Log source: windows/

Description:
Detects the creation of new msDS-DelegatedManagedServiceAccount objects, which could indicate potential abuse of privilege escalation vulnerabilities in Windows Server 2025.
The msDS-DelegatedManagedServiceAccount (DMSA) is a new object class introduced in Windows Server 2025 that allows administrators to delegate the management of service accounts to other users or groups.
Attackers may exploit this feature to create unauthorized service accounts with elevated privileges, leading to privilege escalation within the Active Directory environment.
It is highly suspicious if an msDS-DelegatedManagedServiceAccount object is created without proper authorization or in an unexpected context, such as by a non-administrative user or outside of normal administrative workflows.
So, it's a good idea to look out for accounts that are not typically responsible for service account creation to detect potential abuse of this feature.


Detection logic:
{
  "selection": {
    "EventID": 5137,
    "ObjectClass": "msDS-DelegatedManagedServiceAccount"
  },
  "filter_main_legitimate_accounts": [
    {
      "SubjectAccountName": "SYSTEM"
    },
    {
      "SubjectAccountName|expand": "%Administrators%"
    }
  ],
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://www.akamai.com/blog/security-research/abusing-dmsa-for-privilege-escalation-in-active-directory
Sigma Detection Rule: msDS-ManagedAccountPrecededByLink Attribute Modified
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-05-24
ATT&CK techniques: T1078.002, T1098
Log source: windows/

Description:
Detects modifications to the msDS-ManagedAccountPrecededByLink attribute, which may indicate an attempted or successful abuse of the BaD-Successor msDS-DelegatedManagedServiceAccount (DMSA) vulnerability.
The DMSA is a new object class introduced in Windows Server 2025 that allows administrators to delegate the management of service accounts to other users or groups.
Changes to this attribute by suspicious accounts or outside of normal administrative workflows are a strong signal of an attempted or successful abuse.
If it is indeed modified by an account that is not typically responsible for such changes, it could indicate an attempt to exploit the BaD-Successor vulnerability for privilege escalation within the Windows Server 2025 Active Directory environment.


Detection logic:
{
  "selection": {
    "EventID": 5136,
    "ObjectClass": "msDS-DelegatedManagedServiceAccount",
    "AttributeLDAPDisplayName": "msDS-ManagedAccountPrecededByLink"
  },
  "filter_main_legitimate_accounts": [
    {
      "SubjectAccountName": "SYSTEM"
    },
    {
      "SubjectAccountName|expand": "%Administrators%"
    }
  ],
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://www.akamai.com/blog/security-research/abusing-bad-successor-for-privilege-escalation-in-active-directory
Sigma Detection Rule: Interactive Logon to Server Systems
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2017-03-17
ATT&CK techniques: T1078
Log source: windows/

Description:
Detects interactive console logons to Server Systems

Detection logic:
{
  "selection": {
    "EventID": [
      528,
      529,
      4624,
      4625
    ],
    "LogonType": 2,
    "ComputerName|expand": [
      "%ServerSystems%",
      "%DomainControllers%"
    ]
  },
  "filter_main_advapi": {
    "LogonProcessName": "Advapi",
    "ComputerName|expand": "%Workstations%"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - Internal Research
Sigma Detection Rule: Potential Zerologon (CVE-2020-1472) Exploitation
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Aleksandr Akhremchik, @aleqs4ndr, ocsd.community
Date: 2020-10-15
ATT&CK techniques: T1068
Log source: windows/

Description:
Detects potential Netlogon Elevation of Privilege Vulnerability aka Zerologon (CVE-2020-1472)

Detection logic:
{
  "selection": {
    "EventID": 4742,
    "SubjectUserName": "ANONYMOUS LOGON",
    "TargetUserName|expand": "%DC-MACHINE-NAME%"
  },
  "filter_main": {
    "PasswordLastSet": "-"
  },
  "condition": "selection and not filter_main"
}

References:
  - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1472
  - https://www.logpoint.com/en/blog/detecting-zerologon-vulnerability-in-logpoint/
Sigma Detection Rule: Remote Registry Management Using Reg Utility
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Teymur Kheirkhabarov, oscd.community
Date: 2019-10-22
ATT&CK techniques: T1012, T1112, T1552.002
Log source: windows/

Description:
Remote registry management using REG utility from non-admin workstation

Detection logic:
{
  "selection": {
    "EventID": 5145,
    "RelativeTargetName|contains": "\\winreg"
  },
  "filter_main": {
    "IpAddress|expand": "%Admins_Workstations%"
  },
  "condition": "selection and not filter_main"
}

References:
  - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
Sigma Detection Rule: User with Privileges Logon
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: frack113
Date: 2022-10-14
ATT&CK techniques: T1558, T1649, T1550
Log source: windows/

Description:
Detects logon with "Special groups" and "Special Privileges" can be thought of as Administrator groups or privileges.

Detection logic:
{
  "selection": {
    "EventID": [
      4672,
      4964
    ]
  },
  "filter_main_local_system": {
    "SubjectUserSid": "S-1-5-18"
  },
  "filter_main_valid_account": {
    "SubjectUserName|expand": "%Admins_Workstations%"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://github.com/Yamato-Security/EnableWindowsLogSettings/blob/7f6d755d45ac7cc9fc35b0cbf498e6aa4ef19def/ConfiguringSecurityLogAuditPolicies.md
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4672
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4964
Sigma Detection Rule: Potential Pass the Hash Activity
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Ilias el Matani (rule), The Information Assurance Directorate at the NSA (method)
Date: 2017-03-08
ATT&CK techniques: T1550.002
Log source: windows/

Description:
Detects the attack technique pass the hash which is used to move laterally inside the network

Detection logic:
{
  "selection": {
    "EventID": [
      4624,
      4625
    ],
    "LogonType": 3,
    "LogonProcessName": "NtLmSsp",
    "WorkstationName|expand": "%Workstations%",
    "ComputerName|expand": "%Workstations%"
  },
  "filter": {
    "TargetUserName": "ANONYMOUS LOGON"
  },
  "condition": "selection and not filter"
}

References:
  - https://github.com/nsacyber/Event-Forwarding-Guidance/tree/6e92d622fa33da911f79e7633da4263d632f9624/Events
Sigma Detection Rule: Userdomain Variable Enumeration
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Christopher Peacock @SecurePeacock, SCYTHE @scythe_io
Date: 2023-02-09
ATT&CK techniques: T1016
Log source: windows/process_creation

Description:
Detects suspicious enumeration of the domain the user is associated with.

Detection logic:
{
  "selection": {
    "CommandLine|contains": "echo ",
    "CommandLine|contains|expand": "%userdomain%"
  },
  "condition": "selection"
}

References:
  - https://www.arxiv-vanity.com/papers/2008.04676/
  - https://thedfirreport.com/2022/11/14/bumblebee-zeros-in-on-meterpreter/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Patrick Bareiss, Splunk
Date: 2026-04-15

Description:
The following analytic detects the pulling of known Kubernetes security scanner images such as kube-hunter, kube-bench, and kube-recon. It leverages Kubernetes logs ingested through Splunk Connect for Kubernetes, specifically monitoring for messages indicating the pulling of these images. This activity is significant because the use of security scanners can indicate an attempt to identify vulnerabilities within the Kubernetes environment. If confirmed malicious, this could lead to the discovery and exploitation of security weaknesses, potentially compromising the entire Kubernetes cluster.

References:
  - https://github.com/splunk/splunk-connect-for-kubernetes
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Mauricio Velazco, Splunk
Date: 2026-04-15

Description:
The following analytic identifies instances where a single user creates more than three unique OAuth applications within a 10-minute window in the Office 365 environment. It leverages O365 logs from the Unified Audit Log, focusing on the 'Add service principal' operation in Azure Active Directory. This activity is significant as it may indicate a compromised user account or unauthorized actions, potentially leading to broader network infiltration or privilege escalation. If confirmed malicious, this behavior could allow attackers to gain persistent access, escalate privileges, or exfiltrate sensitive information.

References:
  - https://attack.mitre.org/techniques/T1136/003/
  - https://www.microsoft.com/en-us/security/blog/2024/01/25/midnight-blizzard-guidance-for-responders-on-nation-state-attack/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Bhavin Patel, Splunk
Date: 2026-04-15

Description:
The following analytic identifies a single source IP failing to authenticate into the AWS Console with multiple valid users. It uses CloudTrail logs and calculates the standard deviation for source IP, leveraging the 3-sigma rule to detect unusual numbers of failed authentication attempts. This behavior is significant as it may indicate a Password Spraying attack, where an adversary attempts to gain initial access or elevate privileges. If confirmed malicious, this activity could lead to unauthorized access, data breaches, or further exploitation within the AWS environment.

References:
  - https://attack.mitre.org/techniques/T1110/003/
  - https://www.whiteoaksecurity.com/blog/goawsconsolespray-password-spraying-tool/
  - https://softwaresecuritydotblog.wordpress.com/2019/09/28/how-to-protect-against-credential-stuffing-on-aws/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Steven Dick
Date: 2026-04-15

Description:
The following analytic identifies when a suspicious email is detected within the Microsoft Office 365 ecosystem through the Advanced Threat Protection engine and delivered to an end user. Attackers may execute several attacks through email, any detections from built-in Office 365 capabilities should be monitored and responded to appropriately. Certain premium Office 365 capabilities such as Safe Attachment and Safe Links further enhance these detection and response functions.

References:
  - https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-malware-protection-for-spo-odfb-teams-about?view=o365-worldwide
  - https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/office-365-ti?view=o365-worldwide
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Patrick Bareiss, Splunk
Date: 2026-05-04

Description:
The following analytic detects the deletion of AWS Network Access Control Lists (ACLs). It leverages AWS CloudTrail logs to identify events where a user deletes a network ACL entry. This activity is significant because deleting a network ACL can remove critical access restrictions, potentially allowing unauthorized access to cloud instances. If confirmed malicious, this action could enable attackers to bypass network security controls, leading to unauthorized access, data exfiltration, or further compromise of the cloud environment.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Patrick Bareiss, Splunk
Date: 2026-02-25

Description:
The following analytic detects the successful deletion of a group within AWS IAM, leveraging CloudTrail IAM events. This action, while not inherently malicious, can serve as a precursor to more sinister activities, such as unauthorized access or privilege escalation attempts. By monitoring for such deletions, the analytic aids in identifying potential preparatory steps towards an attack, allowing for early detection and mitigation. The identification of this behavior is crucial for a SOC to prevent the potential impact of an attack, which could include unauthorized access to sensitive resources or disruption of AWS environment operations.

References:
  - https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/delete-group.html
  - https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteGroup.html
Sigma Detection Rule: 
Repository: splunk/security_content
Status: experimental
Author: Teoderick Contreras, Splunk
Date: 2026-04-15

Description:
The following analytic detects Google Drive or Google Docs files shared externally from an internal domain. It leverages GSuite Drive logs, extracting and comparing the source and destination email domains to identify external sharing. This activity is significant as it may indicate potential data exfiltration by an attacker or insider. If confirmed malicious, this could lead to unauthorized access to sensitive information, data leakage, and potential compliance violations. Monitoring this behavior helps in early detection and mitigation of data breaches.

References:
  - https://www.redhat.com/en/topics/devops/what-is-devsecops
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Steven Dick
Date: 2026-04-15

Description:
The following analytic detects when Microsoft Office 365 Data Loss Prevention (DLP) rules have been triggered. DLP rules can be configured for any number of security, regulatory, or business compliance reasons, as such this analytic will only be as accurate as the upstream DLP configuration. Detections from this analytic should be evaluated thoroughly to de termine what, if any, security relevance the underlying DLP events contain.

References:
  - https://learn.microsoft.com/en-us/purview/dlp-learn-about-dlp
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2026-04-15

Description:
The following analytic detects suspicious attachment file extensions in GSuite emails, potentially indicating a spear-phishing attack. It leverages GSuite Gmail logs to identify emails with attachments having file extensions commonly associated with malware, such as .exe, .bat, and .js. This activity is significant as these file types are often used to deliver malicious payloads, posing a risk of compromising targeted machines. If confirmed malicious, this could lead to unauthorized code execution, data breaches, or further network infiltration.

References:
  - https://www.redhat.com/en/topics/devops/what-is-devsecops
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Patrick Bareiss, Splunk
Date: 2026-05-04

Description:
The following analytic detects when branch rulesets are deleted in GitHub Organizations. The detection monitors GitHub Organizations audit logs for branch ruleset deletion events by tracking actor details, repository information, and associated metadata. For a SOC, identifying deleted branch rulesets is critical as it could indicate attempts to bypass code review requirements and security controls. Branch rulesets are essential security controls that enforce code review, prevent force pushes, and maintain code quality. Disabling these protections could allow malicious actors to directly push unauthorized code changes or backdoors to protected branches. The impact of disabled branch protection includes potential code tampering, bypass of security reviews, introduction of vulnerabilities or malicious code, and compromise of software supply chain integrity. This activity could be part of a larger attack chain where an adversary first disables security controls before attempting to inject malicious code.

References:
  - https://splunk.github.io/splunk-add-on-for-github-audit-log-monitoring/Install/
  - https://www.googlecloudcommunity.com/gc/Community-Blog/Monitoring-for-Suspicious-GitHub-Activity-with-Google-Security/ba-p/763610
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: David Dorsey, Splunk
Date: 2026-04-15

Description:
The following analytic detects cloud API calls executed by user roles that have not previously run these commands. It leverages the Change data model in Splunk to identify commands executed by users with the user_type of AssumedRole and a status of success. This activity is significant because new commands from different user roles can indicate potential malicious activity or unauthorized actions. If confirmed malicious, this behavior could lead to unauthorized access, data breaches, or other damaging outcomes by exploiting new or unmonitored commands within the cloud environment.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Steven Dick
Date: 2026-04-15

Description:
The following analytic identifies when an O365 email recipient receives and then deletes emails for the combination of both password and banking/payroll changes within a short period. This behavior may indicate a compromised account where the threat actor is attempting to redirect the victims payroll to an attacker controlled bank account.

References:
  - https://attack.mitre.org/techniques/T1114/
  - https://www.hhs.gov/sites/default/files/help-desk-social-engineering-sector-alert-tlpclear.pdf
  - https://intelligence.abnormalsecurity.com/attack-library/threat-actor-convincingly-impersonates-employee-requesting-direct-deposit-update-in-likely-ai-generated-attack
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk
Date: 2026-04-15

Description:
The following analytic detects the addition of a new owner to a Service Principal within an Azure AD tenant. It leverages Azure Active Directory events from the AuditLog log category to identify this activity. This behavior is significant because Service Principals do not support multi-factor authentication or conditional access policies, making them a target for adversaries seeking persistence or privilege escalation. If confirmed malicious, this activity could allow attackers to maintain access to the Azure AD environment with single-factor authentication, potentially leading to unauthorized access and control over critical resources.

References:
  - https://attack.mitre.org/techniques/T1098/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Mauricio Velazco, Splunk
Date: 2026-04-15

Description:
The following analytic identifies instances where the Mail.Read Graph API permissions are granted to an application registration within an Office 365 tenant. It leverages O365 audit logs, specifically events related to changes in application permissions within the AzureActiveDirectory workload. This activity is significant because the Mail.Read permission allows applications to access and read all emails within a user's mailbox, which often contain sensitive or confidential information. If confirmed malicious, this could lead to data exfiltration, spear-phishing attacks, or further compromise based on the information gathered from the emails.

References:
  - https://attack.mitre.org/techniques/T1098/003/
  - https://attack.mitre.org/techniques/T1114/002/
  - https://www.mandiant.com/sites/default/files/2022-08/remediation-hardening-strategies-for-m365-defend-against-apt29-white-paper.pdf
  - https://www.cisa.gov/sites/default/files/publications/Supply_Chain_Compromise_Detecting_APT_Activity_from_known_TTPs.pdf
  - https://learn.microsoft.com/en-us/graph/permissions-reference
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Patrick Bareiss, Splunk
Date: 2026-04-15

Description:
The following analytic detects the upload of a new container image to AWS Elastic Container Registry (ECR) outside of standard business hours. It leverages AWS CloudTrail logs to identify `PutImage` events occurring between 8 PM and 8 AM or on weekends. This activity is significant because container uploads outside business hours can indicate unauthorized or suspicious activity, potentially pointing to a compromised account or insider threat. If confirmed malicious, this could allow an attacker to deploy unauthorized or malicious containers, leading to potential data breaches or service disruptions.

References:
  - https://attack.mitre.org/techniques/T1204/003/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Rico Valdez, Bhavin Patel, Splunk
Date: 2026-04-15

Description:
The following analytic detects cloud provisioning activities originating from previously unseen cities. It leverages cloud infrastructure logs and compares the geographic location of the source IP address against a baseline of known locations. This activity is significant as it may indicate unauthorized access or misuse of cloud resources from an unexpected location. If confirmed malicious, this could lead to unauthorized resource creation, potential data exfiltration, or further compromise of cloud infrastructure.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Patrick Bareiss, Splunk
Date: 2026-04-15

Description:
The following analytic detects when a repository is archived in GitHub Organizations. The detection monitors GitHub Organizations audit logs for repository archival events by tracking actor details, repository information, and associated metadata. For a SOC, identifying repository archival is important as it could indicate attempts to make critical code inaccessible or preparation for repository deletion. While archiving is a legitimate feature, unauthorized archival of active repositories could signal account compromise, insider threats, or attempts to disrupt development operations. The impact of unauthorized repository archival includes loss of active development access, disruption to workflows and CI/CD pipelines, and potential business delays if critical repositories are affected. Additionally, archived repositories may be targeted for subsequent deletion, potentially resulting in permanent loss of intellectual property if proper backups are not maintained.

References:
  - https://splunk.github.io/splunk-add-on-for-github-audit-log-monitoring/Install/
  - https://www.googlecloudcommunity.com/gc/Community-Blog/Monitoring-for-Suspicious-GitHub-Activity-with-Google-Security/ba-p/763610