deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Nasreddine Bencherchali, Splunk
Date: 2026-04-15

Description:
This analytic detects file copy operations to remote locations on Cisco ASA devices via CLI or ASDM.
Adversaries may exfiltrate device files including configurations, logs, packet captures, or system data to remote servers using protocols like TFTP, FTP, HTTP, HTTPS, SMB, or SCP. While legitimate backups to centralized servers are common, copies to unexpected destinations may indicate data exfiltration to attacker-controlled infrastructure.
The detection monitors for command execution events (message ID 111008 or 111010) containing copy commands with remote protocol indicators (tftp:, ftp:, http:, https:, smb:, scp:).
Investigate copies to unexpected destinations, from non-administrative accounts, or outside approved maintenance windows.
We recommend adapting the detection filters to exclude known legitimate backup activities.


References:
  - https://community.cisco.com/t5/security-knowledge-base/asa-how-to-download-images-using-tftp-ftp-http-https-and-scp/ta-p/3109769
  - https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: experimental
Author: Rod Soto
Date: 2026-04-15

Description:
Detects abnormal network activity and connectivity issues in Ollama including non-localhost API access attempts and warning-level network errors such as DNS lookup failures, TCP connection issues, or host resolution problems that may indicate network-based attacks, unauthorized access attempts, or infrastructure reconnaissance activity.

References:
  - https://github.com/rosplk/ta-ollama
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Mauricio Velazco, Splunk
Date: 2026-04-15

Description:
The following analytic identifies instances where more than 10 unique user accounts have failed to authenticate from a single IP address within a 5-minute window in an Okta tenant. This detection uses OktaIm2 logs ingested via the Splunk Add-on for Okta Identity Cloud. Such activity is significant as it may indicate brute-force attacks or password spraying attempts. If confirmed malicious, this behavior suggests an external entity is attempting to compromise multiple user accounts, potentially leading to unauthorized access to organizational resources and data breaches.

References:
  - https://attack.mitre.org/techniques/T1110/003/
  - https://splunkbase.splunk.com/app/6553
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2026-04-15

Description:
The following analytic identifies when an associate reports a login attempt as suspicious via an email from Okta. It leverages Okta Identity Management logs, specifically the `user.account.report_suspicious_activity_by_enduser` event type. This activity is significant as it indicates potential unauthorized access attempts, warranting immediate investigation to prevent possible security breaches. If confirmed malicious, the attacker could gain unauthorized access to sensitive systems and data, leading to data theft, privilege escalation, or further compromise of the environment.

References:
  - https://help.okta.com/en-us/Content/Topics/Security/suspicious-activity-reporting.htm
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Raven Tait, Splunk
Date: 2026-05-04

Description:
Detects the disabling of critical encryption enforcement settings on an ESXi host, such as secure boot or executable verification requirements, which may indicate an attempt to weaken hypervisor integrity or allow unauthorized code execution.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Nasreddine Bencherchali, Splunk
Date: 2026-05-04

Description:
This analytic detects suppression of specific logging messages on Cisco ASA devices using the "no logging message" command.
Adversaries may suppress specific log message IDs to selectively disable logging of security-critical events such as authentication failures, configuration changes, or suspicious network activity. This targeted approach allows attackers to evade detection while maintaining normal logging operations that might otherwise alert administrators to complete logging disablement.
The detection monitors for command execution events (message ID 111008 or 111010) containing the "no logging message" command, which is used to suppress specific message IDs from being logged regardless of the configured severity level.
Investigate unauthorized message suppression, especially suppression of security-critical message IDs (authentication, authorization, configuration changes), suppression performed by non-administrative accounts, during unusual hours, or without documented justification.


References:
  - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/RayInitiator-LINE-VIPER/ncsc-mar-rayinitiator-line-viper.pdf
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Nasreddine Bencherchali, Splunk
Date: 2026-04-15

Description:
This analytic detects file copy activity on Cisco ASA devices via CLI or ASDM.
Adversaries may copy device files including configurations, logs, packet captures, or system files for reconnaissance, credential extraction, or data exfiltration. While legitimate file operations occur during backups and maintenance, unauthorized copies may indicate malicious activity.
The detection monitors for command execution events (message ID 111008 or 111010) containing copy commands targeting running-config, startup-config, packet capture files, or other system files from disk0:, flash:, system:, or capture: locations.
Investigate unexpected file copies, especially from non-administrative accounts, during unusual hours, or when combined with other suspicious activities.


References:
  - https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Raven Tait, Splunk
Date: 2026-04-15

Description:
This detection identifies when a user is granted the Administrator role on an ESXi host. Assigning elevated privileges is a critical action that can indicate potential malicious behavior if performed unexpectedly. Adversaries who gain access may use this to escalate privileges, maintain persistence, or disable security controls.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Raven Tait, Splunk
Date: 2026-05-04

Description:
This detection identifies the use of the esxcli system auditrecords commands, which can be used to tamper with logging on an ESXi host. This action may indicate an attempt to evade detection or hinder forensic analysis by preventing the recording of system-level audit events.

References:
  - https://detect.fyi/detecting-and-responding-to-esxi-compromise-with-splunk-f33998ce7823
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Raven Tait, Splunk
Date: 2026-04-15

Description:
This detection identifies a significant change to the system clock on an ESXi host, which may indicate an attempt to manipulate timestamps and evade detection or forensic analysis
Sigma Detection Rule: 
Repository: splunk/security_content
Status: experimental
Author: Rod Soto
Date: 2026-04-15

Description:
Detects abnormal memory allocation patterns and excessive runner operations in Ollama that may indicate resource exhaustion attacks, memory abuse through malicious model loading, or attempts to degrade system performance by overwhelming GPU/CPU resources. Adversaries may deliberately load multiple large models, trigger repeated model initialization cycles, or exploit memory allocation mechanisms to exhaust available system resources, causing denial of service conditions or degrading performance for legitimate users.

References:
  - https://github.com/rosplk/ta-ollama
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Dean Luxton
Date: 2026-02-25

Description:
This analytic employs the 3-sigma approach to identify distributed password spray attacks. A distributed password spray attack is a type of brute force attack where the attacker attempts a few common passwords against many different accounts, connecting from multiple IP addresses to avoid detection. By utilizing the Authentication Data Model, this detection is effective for all CIM-mapped authentication events, providing comprehensive coverage and enhancing security against these attacks.

References:
  - https://attack.mitre.org/techniques/T1110/003/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Rod Soto
Date: 2026-02-25

Description:
This detection identifies potentially malicious SQL queries executed through MCP PostgreSQL server connections, monitoring for privilege escalation attempts, credential theft, and schema reconnaissance. These patterns are commonly observed in SQL injection attacks, compromised application credentials, and insider threat scenarios targeting database assets.

References:
  - https://splunkbase.splunk.com/app/8377
  - https://www.nodejs-security.com/blog/the-tale-of-the-vulnerable-mcp-database-server
  - https://www.splunk.com/en_us/blog/security/securing-ai-agents-model-context-protocol.html
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Mauricio Velazco, Splunk
Date: 2026-04-15

Description:
The following analytic detects multiple Okta accounts being locked out within a short period. It uses the user.account.lock event from Okta logs, aggregated over a 5-minute window, to identify this behavior. This activity is significant as it may indicate a brute force or password spraying attack, where an adversary attempts to guess passwords, leading to account lockouts. If confirmed malicious, this could result in potential account takeovers or unauthorized access to sensitive Okta accounts, posing a significant security risk.

References:
  - https://attack.mitre.org/techniques/T1110/
  - https://splunkbase.splunk.com/app/6553
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Nasreddine Bencherchali, Splunk
Date: 2026-04-15

Description:
This analytic detects privilege level changes for user accounts on Cisco ASA devices via CLI or ASDM.
Adversaries may escalate account privileges to gain elevated access to network infrastructure, enable additional command execution capabilities, or establish higher-level persistent access. Privilege levels on Cisco ASA range from 0 (lowest) to 15 (full administrative access), with level 15 providing complete device control.
The detection monitors for ASA message ID 502103, which is generated whenever a user account's privilege level is modified, capturing both the old and new privilege levels along with the username and administrator who made the change.
Investigate unexpected privilege changes, especially escalations to level 15, substantial privilege increases (e.g., from level 1 to 15), changes performed outside business hours, changes by non-administrative users, or changes without corresponding change management tickets.


References:
  - https://www.cisco.com/c/en/us/td/docs/security/asa/syslog/asa-syslog/syslog-messages-500000-to-520025.html#con_4773975
  - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/RayInitiator-LINE-VIPER/ncsc-mar-rayinitiator-line-viper.pdf
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2026-04-15

Description:
This analytic detects potential exploitation of the Ivanti Virtual Traffic Manager (vTM) authentication bypass vulnerability (CVE-2024-7593) to create new administrator accounts. The vulnerability allows unauthenticated remote attackers to bypass authentication on the admin panel and create new admin users. This detection looks for suspicious new account creation events in the Ivanti vTM audit logs that lack expected authentication details, which may indicate exploitation attempts.

References:
  - https://www.ivanti.com/security/security-advisories/ivanti-virtual-traffic-manager-vtm-cve-2024-7593
  - https://nvd.nist.gov/vuln/detail/CVE-2024-7593
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Patrick Bareiss, Splunk
Date: 2026-04-15

Description:
The following analytic detects instances where a Duo administrator performs a bulk deletion of more than three policies in a single action. It identifies this behavior by searching Duo activity logs for the policy_bulk_delete action, extracting the names of deleted policies, and counting them. If the count exceeds three, the event is flagged. This behavior is significant for a Security Operations Center (SOC) because mass deletion of security policies can indicate malicious activity, such as an attacker or rogue administrator attempting to weaken or disable security controls, potentially paving the way for further compromise. Detecting and investigating such actions promptly is critical, as the impact of this attack could include reduced security posture, increased risk of unauthorized access, and potential data breaches. Monitoring for bulk policy deletions helps ensure that any suspicious or unauthorized changes to security configurations are quickly identified and addressed to protect organizational assets and maintain compliance.

References:
  - https://splunkbase.splunk.com/app/7404
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Raven Tait, Splunk
Date: 2026-05-04

Description:
This detection identifies failed file download attempts on ESXi hosts by looking for specific error messages in the system logs. These failures may indicate unauthorized or malicious attempts to install or update components—such as VIBs or scripts
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Marissa Bower, Mauricio Velazco, Splunk
Date: 2026-02-25

Description:
The following analytic detects patterns of successful and failed Okta MFA push attempts to identify potential MFA exhaustion attacks. It leverages Okta event logs, specifically focusing on push verification events, and uses statistical evaluations to determine suspicious activity. This activity is significant as it may indicate an attacker attempting to bypass MFA by overwhelming the user with push notifications. If confirmed malicious, this could lead to unauthorized access, compromising the security of the affected accounts and potentially the entire environment.

References:
  - https://developer.okta.com/docs/reference/api/event-types/?q=user.acount.lock
  - https://sec.okta.com/everythingisyes
  - https://splunkbase.splunk.com/app/6553
Sigma Detection Rule: 
Repository: splunk/security_content
Status: experimental
Author: Bhavin Patel, Splunk
Date: 2026-03-10

Description:
The following analytic identifies new login attempts to routers. It leverages authentication logs from the ES Assets and Identity Framework, focusing on assets categorized as routers. The detection flags connections that have not been observed in the past 30 days. This activity is significant because unauthorized access to routers can lead to network disruptions or data interception. If confirmed malicious, attackers could gain control over network traffic, potentially leading to data breaches or further network compromise.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: experimental
Author: Rod Soto
Date: 2026-05-04

Description:
Detects M365 Copilot jailbreak attempts through prompt injection techniques including rule manipulation, system bypass commands, and AI impersonation requests that attempt to circumvent built-in safety controls. The detection searches exported eDiscovery prompt logs for jailbreak keywords like "pretend you are," "act as," "rules=," "ignore," "bypass," and "override" in the Subject_Title field, assigning severity scores based on the manipulation type (score of 4 for amoral impersonation or explicit rule injection, score of 3 for entity roleplay or bypass commands). Prompts with a jailbreak score of 2 or higher are flagged, prioritizing the most severe attempts to override AI safety mechanisms through direct instruction injection or unauthorized persona adoption.

References:
  - https://www.splunk.com/en_us/blog/artificial-intelligence/m365-copilot-log-analysis-splunk.html
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Steven Dick
Date: 2026-04-15

Description:
The following analytic detects the registration of a new Multi-Factor Authentication (MFA) method for a PingID (PingOne) account. It leverages JSON logs from PingID, specifically looking for successful device pairing events. This activity is significant as adversaries who gain unauthorized access to a user account may register a new MFA method to maintain persistence. If confirmed malicious, this could allow attackers to bypass existing security measures, maintain long-term access, and potentially escalate their privileges within the compromised environment.

References:
  - https://twitter.com/jhencinski/status/[PII_REDACTED]52007174
  - https://attack.mitre.org/techniques/T1098/005/
  - https://attack.mitre.org/techniques/T1556/006/
  - https://docs.pingidentity.com/r/en-us/pingoneforenterprise/p14e_subscriptions?tocId=3xhnxjX3VzKNs3SXigWnQA
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Rod Soto
Date: 2026-03-10

Description:
Detects M365 Copilot users accessing from multiple geographic locations to identify potential account compromise, credential sharing, or impossible travel patterns. The detection aggregates M365 Copilot Graph API events per user, calculating distinct cities and countries accessed, unique IP addresses, and the observation timeframe to compute a locations-per-day metric that measures geographic mobility. Users accessing Copilot from more than one city (cities_count > 1) are flagged and sorted by country and city diversity, surfacing accounts exhibiting anomalous geographic patterns that suggest compromised credentials being used from distributed locations or simultaneous access from impossible travel distances.

References:
  - https://www.splunk.com/en_us/blog/artificial-intelligence/m365-copilot-log-analysis-splunk.html
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Patrick Bareiss, Splunk
Date: 2026-04-15

Description:
The following analytic detects when a Duo policy is created or updated to allow tampered or rooted devices, such as jailbroken smartphones,
to access protected resources. It identifies this behavior by searching Duo administrator activity logs for policy changes where the allow_rooted_devices
setting is enabled. This is accomplished by filtering for policy creation or update actions and parsing the policy description for the relevant configuration.
Allowing tampered devices poses a significant security risk, as these devices may bypass built-in security controls, run unauthorized software, or be more
susceptible to compromise. For a Security Operations Center (SOC), identifying such policy changes is critical because it may indicate either a
misconfiguration or a malicious attempt to weaken authentication requirements, potentially enabling attackers to access sensitive systems with
compromised devices. The impact of this attack can include unauthorized access, data breaches, and lateral movement within the environment,
making prompt detection and response essential to maintaining organizational security.


References:
  - https://splunkbase.splunk.com/app/7404
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Scott Dermott, Felicity Robson, Okta, Michael Haag, Bhavin Patel, Splunk
Date: 2026-04-15

Description:
The following analytic identifies suspicious use of a session cookie by detecting multiple client values (IP, User Agent, etc.) changing for the same Device Token associated with a specific user. It leverages policy evaluation events from successful authentication logs in Okta. This activity is significant as it may indicate an adversary attempting to reuse a stolen web session cookie, potentially bypassing authentication mechanisms. If confirmed malicious, this could allow unauthorized access to user accounts, leading to data breaches or further exploitation within the environment.

References:
  - https://attack.mitre.org/techniques/T1539/
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Raven Tait, Splunk
Date: 2026-04-15

Description:
This detection identifies when all virtual machines on an ESXi host are abruptly terminated, which may indicate malicious activity such as a deliberate denial-of-service, ransomware staging, or an attempt to destroy critical workloads.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Raven Tait, Splunk
Date: 2026-04-15

Description:
This detection identifies the use of ESXCLI system-level commands that retrieve configuration details. While used for legitimate administration, this behavior may also indicate adversary reconnaissance aimed at profiling the ESXi host's capabilities, build information, or system role in preparation for further compromise.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: experimental
Author: David Dorsey, Splunk
Date: 2026-03-10

Description:
The following analytic identifies emails claiming to be sent from a domain similar to one you are monitoring for potential abuse. It leverages email header data, specifically the sender's address, and cross-references it with a lookup table of known domain permutations generated by the "ESCU - DNSTwist Domain Names" search. This activity is significant as it can indicate phishing attempts or brand impersonation, which are common tactics used in social engineering attacks. If confirmed malicious, this could lead to unauthorized access, data theft, or reputational damage.
Sigma Detection Rule: 
Repository: splunk/security_content
Status: production
Author: Michael Haag, Splunk
Date: 2026-04-15

Description:
This analytic is designed to identify attempts to exploit a server-side template injection vulnerability in CrushFTP, designated as CVE-2024-4040. This severe vulnerability enables unauthenticated remote attackers to access and read files beyond the VFS Sandbox, circumvent authentication protocols, and execute arbitrary commands on the affected server. The issue impacts all versions of CrushFTP up to 10.7.1 and 11.1.0 on all supported platforms. It is highly recommended to apply patches immediately to prevent unauthorized access to the system and avoid potential data compromises. The search specifically looks for patterns in the raw log data that match the exploitation attempts, including READ or WRITE actions, and extracts relevant information such as the protocol, session ID, user, IP address, HTTP method, and the URI queried. It then evaluates these logs to confirm traces of exploitation based on the presence of specific keywords and the originating IP address, counting and sorting these events for further analysis.

References:
  - https://github.com/airbus-cert/CVE-2024-4040
  - https://www.bleepingcomputer.com/news/security/crushftp-warns-users-to-patch-exploited-zero-day-immediately/