deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: David Dorsey, Splunk
Date: 2024-09-24

Description:
Detect tactics used by malware to evade defenses on Windows endpoints. A few of these include suspicious `reg.exe` processes, files hidden with `attrib.exe` and disabling user-account control, among many others

References:
  - https://attack.mitre.org/wiki/Defense_Evasion
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Mauricio Velazco, Splunk
Date: 2021-08-31

Description:
PetitPotam (CVE-2021-36942,) is a vulnerablity identified in Microsofts EFSRPC Protocol that can allow an unauthenticated account to escalate privileges to domain administrator given the right circumstances.

References:
  - https://us-cert.cisa.gov/ncas/current-activity/2021/07/27/microsoft-releases-guidance-mitigating-petitpotam-ntlm-relay
  - https://support.microsoft.com/en-us/topic/kb5005413-mitigating-ntlm-relay-attacks-on-active-directory-certificate-services-ad-cs-3612b773-4043-4aa9-b23d-b87910cd3429
  - https://www.specterops.io/assets/resources/Certified_Pre-Owned.pdf
  - https://github.com/topotam/PetitPotam/
  - https://github.com/gentilkiwi/mimikatz/releases/tag/2.2.0-20210723
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2025-08-05

Description:
Detects suspicious use of captive portal redirection chains abusing msftconnecttest.com/redirect, particularly during network sign-in events. Look for anomalous HTTP GET requests to domains mimicking certificate authorities (e.g., fake Digicert or Kaspersky-related hosts). Flag user execution of CertificateDB.exe, which may request elevated privileges and install unauthorized custom root certificates. Monitor for persistence tactics such as creation of hidden local admin accounts, modification of firewall or network profile settings, and DLL sideloading involving oci.dll or duser.dll. Additional indicators include encoded metadata in DNS queries, exfiltration over DNS, or encrypted communications to suspicious or newly registered domains, suggesting command-and-control activity. These behaviors may indicate adversary-in-the-middle (AiTM) interception by a capable, nation-state actor.

References:
  - https://www.microsoft.com/en-us/security/blog/2025/07/31/frozen-in-transit-secret-blizzards-aitm-campaign-against-diplomats/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2022-10-14

Description:
Fortinet recently patched a critical authentication bypass vulnerability in their FortiOS, FortiProxy, and FortiSwitchManager projects CVE-2022-40684.

References:
  - https://www.wordfence.com/blog/2022/10/threat-advisory-cve-2022-40684-fortinet-appliance-auth-bypass/
  - https://www.horizon3.ai/fortios-fortiproxy-and-fortiswitchmanager-authentication-bypass-technical-deep-dive-cve-2022-40684/
  - https://github.com/horizon3ai/CVE-2022-40684
  - https://attackerkb.com/topics/QWOxGIKkGx/cve-2022-40684/rapid7-analysis
  - https://www.greynoise.io/blog/fortios-authentication-bypass
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2022-06-09

Description:
Leverage searches that allow you to detect and investigate unusual activities that might relate to the Azorult malware including firewall modification, icacl execution, spawning more process, botnet c2 communication, defense evasion and etc. The AZORULT malware was first discovered in 2016 to be an information stealer that steals browsing history, cookies, ID/passwords, cryptocurrency information and more. It can also be a downloader of other malware. A variant of this malware was able to create a new, hidden administrator account on the machine to set a registry key to establish a Remote Desktop Protocol (RDP) connection. Exploit kits such as Fallout Exploit Kit (EK) and phishing mails with social engineering technique are one of the major infection vectors of the AZORult malware. The current malspam and phishing emails use fake product order requests, invoice documents and payment information requests. This Trojan-Spyware connects to Command And Control (C&C) servers of attacker to send and receive information.

References:
  - https://success.trendmicro.com/dcx/s/solution/000146108-azorult-malware-information?language=en_US&sfdcIFrameOrigin=null
  - https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2022-09-30

Description:
Two new zero day Microsoft Exchange vulnerabilities have been identified actively exploited in the wild - CVE-2022-41040 and CVE-2022-41082.

References:
  - https://msrc-blog.microsoft.com/2022/09/29/customer-guidance-for-reported-zero-day-vulnerabilities-in-microsoft-exchange-server/
  - https://twitter.com/GossiTheDog/status/[PII_REDACTED]53916417?s=20&t=67gq9xCWuyPm1VEm8ydfyA
  - https://twitter.com/cglyer/status/[PII_REDACTED]14728705?s=20&t=67gq9xCWuyPm1VEm8ydfyA
  - https://www.gteltsc.vn/blog/warning-new-attack-campaign-utilized-a-new-0day-rce-vulnerability-on-microsoft-exchange-server-12715.html
  - https://research.splunk.com/stories/proxyshell/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2023-08-24

Description:
A critical vulnerability, designated as CVE-2023-38035, has been identified in Ivanti Sentry (formerly MobileIron Sentry). It affects all supported versions, including 9.18, 9.17, and 9.16, as well as older versions. The vulnerability allows an unauthenticated attacker to access the System Manager Portal (typically hosted on port 8443) and make configuration changes, potentially executing OS commands as root. However, the risk is low for users who haven't exposed port 8443 online. This flaw is distinct from other Ivanti products. It's imperative for organizations to check for unrecognized HTTP requests to /services/* as a potential indicator of compromise.

References:
  - https://github.com/horizon3ai/CVE-2023-38035/blob/main/CVE-2023-38035.py
  - https://www.horizon3.ai/ivanti-sentry-authentication-bypass-cve-2023-38035-deep-dive/
  - https://forums.ivanti.com/s/article/KB-API-Authentication-Bypass-on-Sentry-Administrator-Interface-CVE-2023-38035?language=en_US
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2022-11-14

Description:
QakBot is a modular banking trojan that has been used primarily by financially-motivated actors since at least 2007. QakBot is continuously maintained and developed and has evolved from an information stealer into a delivery agent for ransomware (ref. MITRE ATT&CK).

References:
  - https://www.cisa.gov/sites/default/files/publications/[PII_REDACTED]30_QakBot%20TLPWHITE.pdf
  - https://malpedia.caad.fkie.fraunhofer.de/details/win.QakBot
  - https://securelist.com/QakBot-technical-analysis/103931/
  - https://www.fortinet.com/blog/threat-research/new-variant-of-QakBot-spread-by-phishing-emails
  - https://attack.mitre.org/software/S0650/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2023-03-15

Description:
Microsoft has released CVE-2023-23397 to address the critical elevation of privilege (EoP) vulnerability affecting Microsoft Outlook for Windows.

References:
  - https://twitter.com/ACEResponder/status/[PII_REDACTED]06818562?s=20
  - https://twitter.com/domchell/status/[PII_REDACTED]82408962?s=20
  - https://msrc.microsoft.com/blog/2023/03/microsoft-mitigates-outlook-elevation-of-privilege-vulnerability/
  - https://www.pwndefend.com/2023/03/15/the-long-game-persistent-hash-theft/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2023-03-10

Description:
A proof-of-concept for CVE-2023-21716, a critical vulnerability in Microsoft Word that allows remote code execution utilizing a heap corruption in rich text files.

References:
  - https://www.bleepingcomputer.com/news/security/proof-of-concept-released-for-critical-microsoft-word-rce-bug/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2021-03-24

Description:
Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis.

References:
  - https://attack.mitre.org/techniques/T1140/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2023-07-26

Description:
This analytic story contains detections that allow security analysts to detect and investigate unusual activities that might related to warzone (Ave maria) RAT. This analytic story looks for suspicious process execution, command-line activity, downloads, persistence, defense evasion and more.

References:
  - https://www.blackberry.com/us/en/solutions/endpoint-security/ransomware-protection/warzone#:~:text=Warzone%20RAT%20(AKA%20Ave%20Maria)%20is%20a%20remote%20access%20trojan,is%20as%20an%20information%20stealer.
  - https://tccontre.blogspot.com/2020/02/2-birds-in-one-stone-ave-maria-wshrat.html
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Raven Tait, Splunk
Date: 2025-10-09

Description:
Leverage searches that allow you to detect and investigate unusual activities that might relate to http request smuggling, including looking for CL.TE,TE.TE,CL.0 and more.

References:
  - https://portswigger.net/web-security/request-smuggling#what-is-http-request-smuggling
  - https://portswigger.net/research/http1-must-die
  - https://www.vaadata.com/blog/what-is-http-request-smuggling-exploitations-and-security-best-practices/
  - https://www.securityweek.com/new-http-request-smuggling-attacks-impacted-cdns-major-orgs-millions-of-websites/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2021-09-06

Description:
Leverage searches that allow you to detect and investigate unusual activities that might relate to the BlackMatter ransomware, including looking for file writes associated with BlackMatter, force safe mode boot, autadminlogon account registry modification and more.

References:
  - https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/
  - https://www.bleepingcomputer.com/news/security/blackmatter-ransomware-gang-rises-from-the-ashes-of-darkside-revil/
  - https://blog.malwarebytes.com/ransomware/2021/07/blackmatter-a-new-ransomware-group-claims-link-to-darkside-revil/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Bhavin Patel, Splunk
Date: 2017-09-13

Description:
Keep a careful inventory of every asset on your network to make it easier to detect rogue devices. Unauthorized/unmanaged devices could be an indication of malicious behavior that should be investigated further.

References:
  - https://www.cisecurity.org/controls/inventory-of-authorized-and-unauthorized-devices/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Bhavin Patel, Splunk
Date: 2020-08-04

Description:
This story is focused around detecting Security Hub alerts generated from AWS

References:
  - https://aws.amazon.com/security-hub/features/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Rico Valdez, Splunk
Date: 2018-12-13

Description:
Leverage searches that allow you to detect and investigate unusual activities that might relate to the SamSam ransomware, including looking for file writes associated with SamSam, RDP brute force attacks, the presence of files with SamSam ransomware extensions, suspicious psexec use, and more.

References:
  - https://www.crowdstrike.com/blog/an-in-depth-analysis-of-samsam-ransomware-and-boss-spider/
  - https://nakedsecurity.sophos.com/2018/07/31/samsam-the-almost-6-million-ransomware/
  - https://thehackernews.com/2018/07/samsam-ransomware-attacks.html
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Teoderick Contreras, Splunk
Date: 2023-06-15

Description:
This analytic story contains detections that allow security analysts to detect and investigate unusual activities that might relate to the destructive attack or campaign found by "THE DFIR Report" that uses Truebot, FlawedGrace and MBR killer malware. This analytic story looks for suspicious dropped files, cobalt strike execution, im-packet execution, registry modification, scripts, persistence, lateral movement, impact, exfiltration and recon.

References:
  - https://thedfirreport.com/2023/06/12/a-truly-graceful-wipe-out/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2023-08-29

Description:
Juniper Networks has resolved multiple critical vulnerabilities in the J-Web component of Junos OS on SRX and EX Series devices. These vulnerabilities, when chained together, could allow an unauthenticated, network-based attacker to remotely execute code on the devices. The vulnerabilities affect all versions of Junos OS on SRX and EX Series, but specific fixes have been released to address each vulnerability. Juniper Networks recommends applying the necessary fixes to mitigate potential remote code execution threats. As a workaround, users can disable J-Web or limit access to only trusted hosts. Proof-of-concept (PoC) exploit code has been released, demonstrating the severity of these flaws and the urgency to apply the fixes.

References:
  - https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=en_US
  - https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-36844.yaml
  - https://thehackernews.com/2023/08/new-juniper-junos-os-flaws-expose.html
  - https://github.com/watchtowrlabs/juniper-rce_cve-2023-36844
  - https://labs.watchtowr.com/cve-2023-36844-and-friends-rce-in-juniper-firewalls/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Nasreddine Bencherchali, Splunk
Date: 2025-10-24

Description:
This analytic story addresses the exploitation of CVE-2025-59287, a critical remote code execution vulnerability in Microsoft Windows Server Update Services (WSUS). Threat actors exploit a deserialization vulnerability in the WSUS AuthorizationCookie to achieve unauthenticated remote code execution on exposed WSUS servers. The attack leverages publicly accessible WSUS instances on default ports 8530/TCP (HTTP) and 8531/TCP (HTTPS) to send specially crafted POST requests that trigger deserialization attacks, resulting in shell spawning from the WSUS service and IIS worker processes.

References:
  - https://www.huntress.com/blog/exploitation-of-windows-server-update-services-remote-code-execution-vulnerability
  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59287
  - https://hawktrace.com/blog/CVE-2025-59287-UNAUTH
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2023-08-24

Description:
In July 2023, CrowdStrike's Falcon Complete managed detection and response (MDR) team uncovered an exploit kit using an unknown vulnerability in the Windows Error Reporting (WER) component. The vulnerability, now identified as CVE-2023-36874, was also independently discovered by Google's Threat Analysis Group. The exploit came to light when suspicious binaries were observed on a European technology system. CrowdStrike's Counter Adversary Operations' analysis revealed a zero-day exploit targeting the WER service, allowing attackers to execute unauthorized code with elevated privileges. The exploit kit seen aimed to spawn a privileged interpreter, displaying the versatility and adaptability of the threat. CrowdStrike has listed some potential indicators of compromise, but these are of low fidelity due to their mutable nature.

References:
  - https://www.crowdstrike.com/blog/falcon-complete-zero-day-exploit-cve-2023-36874/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Shannon Davis, Splunk
Date: 2020-07-28

Description:
Uncover activity consistent with CVE-2020-1350, or SIGRed. Discovered by Checkpoint researchers, this vulnerability affects Windows 2003 to 2019, and is triggered by a malicious DNS response (only affects DNS over TCP). An attacker can use the malicious payload to cause a buffer overflow on the vulnerable system, leading to compromise.  The included searches in this Analytic Story are designed to identify the large response payload for SIG and KEY DNS records which can be used for the exploit.

References:
  - https://research.checkpoint.com/2020/resolving-your-way-into-domain-admin-exploiting-a-17-year-old-bug-in-windows-dns-servers/
  - https://support.microsoft.com/en-au/help/4569509/windows-dns-server-remote-code-execution-vulnerability
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2025-04-16

Description:
Earth Alux is a sophisticated espionage threat actor targeting government, technology, logistics, manufacturing, telecommunications, and IT services sectors primarily in the APAC region and Latin America, using advanced techniques for information theft through a combination of webshells, process injection, DLL side-loading, and credential theft.

References:
  - https://www.trendmicro.com/en_us/research/25/c/the-espionage-toolkit-of-earth-alux.html
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2025-02-04

Description:
This analytic story addresses various techniques used by threat actors to abuse Microsoft SQL Server for maintaining persistence, executing malicious commands, and exfiltrating data. It focuses on detecting suspicious SQLCMD usage, startup procedure modifications, DLL procedure loads, and other SQL Server abuse patterns that may indicate compromise.

References:
  - https://www.microsoft.com/en-us/security/blog/2023/10/03/defending-new-vectors-threat-actors-attempt-sql-server-to-cloud-lateral-movement/
  - https://www.netspi.com/blog/technical-blog/network-pentesting/hijacking-sql-server-credentials-with-agent-jobs-for-domain-privilege-escalation/
  - https://www.huntress.com/blog/attacking-mssql-servers
  - https://www.netspi.com/blog/technical-blog/network-pentesting/hacking-sql-server-stored-procedures-part-2-user-impersonation/
  - https://www.slideshare.net/slideshow/def-con-31-demo-labs-2023-abusing-microsoft-sql-server-with-sqlrecon-259778942/259778942#1
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Patrick Bareiss, Michael Haag, Mauricio Velazco, Splunk
Date: 2020-12-14

Description:
NOBELIUM, also known as APT29, The Dukes, Cozy Bear, CozyDuke, Blue Kitsune, and Midnight Blizzard, is a sophisticated nation-state threat actor, reportedly associated with Russian intelligence. Active since at least 2008, this group primarily targets government networks in Europe and NATO member countries, along with research institutes and think tanks. Their operations typically involve advanced persistent threats (APT), leveraging techniques like spear-phishing, malware deployment, and long-term network compromise to achieve information theft and espionage. Notably, APT29 has been implicated in significant cyber espionage incidents, including the 2015 breach of the Pentagon's Joint Staff email system and attacks on the Democratic National Committee in 2016. Their advanced tactics and persistent approach underscore the serious nature of threats posed by this group to global cybersecurity.

References:
  - https://attack.mitre.org/groups/G0016/
  - https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/
  - https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html
  - https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/
  - https://www.microsoft.com/en-us/security/blog/2024/01/25/midnight-blizzard-guidance-for-responders-on-nation-state-attack/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Mauricio Velazco, Splunk
Date: 2024-09-24

Description:
Monitor for activities and techniques associated with the execution of Persistence techniques against Azure Active Directory tenants.

References:
  - https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-whatis
  - https://azure.microsoft.com/en-us/services/active-directory/#overview
  - https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-compare-azure-ad-to-ad
  - https://attack.mitre.org/tactics/TA0003/
  - https://microsoft.github.io/Azure-Threat-Research-Matrix/Persistence/Persistence/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Mauricio Velazco, Splunk
Date: 2021-04-07

Description:
Monitor for activities and techniques associated with Password Spraying attacks within Active Directory environments.

References:
  - https://attack.mitre.org/techniques/T1110/003/
  - https://www.microsoft.com/security/blog/2020/04/23/protecting-organization-password-spray-attacks/
  - https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn452415(v=ws.11)
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Raven Tait, Splunk
Date: 2026-01-29

Description:
In January 2026, the GNU telnetd service from GNU InetUtils was found to be vulnerable to authentication-bypass by Kyu Neushwaistein (aka Carlos Cortes Alvarez). This flaw allows an attacker to establish a Telnet session without providing valid credentials, granting unauthorized access to the target system.

References:
  - https://www.safebreach.com/blog/safebreach-labs-root-cause-analysis-and-poc-exploit-for-cve-2026-24061/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Bhavin Patel, Splunk
Date: 2024-09-24

Description:
This analytic story contains detections that query your AWS Cloudtrail for activities related to privilege escalation.

References:
  - https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/
  - https://www.cyberark.com/resources/threat-research-blog/the-cloud-shadow-admin-threat-10-permissions-to-protect
  - https://labs.bishopfox.com/tech-blog/privilege-escalation-in-aws