Sync Sigma detections from security_content_sigma PR #42

[P4T12ICK]

Details

Sigma rules added or modified in splunk/security_content_sigma (PR #42) were converted to ESCU detections with sigmaspl convert --output-format security_content.

• Source: https://github.com/splunk/security_content_sigma/pull/42
• Workflow run: https://github.com/splunk/security_content_sigma/actions/runs/38581432071

Each converted file replaces detections/<same relative path>. Review the diff for fields sigmaspl rewrote.

Added Sigma rules

rules/application/ollama_long_running_inference_requests.yml
rules/application/ollama_repeated_application_errors.yml
rules/network/http_post_request_with_encoded_payload.yml
rules/network/unusual_ssh_client_banner.yml
rules/web/unusual_http_request_method.yml

Modified Sigma rules

rules/application/aws_bedrock_claude_cross_region_possible_inference_abuse.yml
rules/application/aws_bedrock_claude_excessive_use_of_tokens.yml
rules/application/aws_bedrock_claude_high_risk_filesystem_and_exec_tool_invocation.yml
rules/application/aws_bedrock_claude_hostile_prompt_sentiment.yml
rules/application/aws_bedrock_claude_possible_prompt_injection.yml
rules/application/aws_bedrock_claude_sensitive_data_in_prompts.yml
rules/application/aws_bedrock_claude_unusually_large_prompts.yml
rules/application/cisco_ai_defense_security_alerts_by_application_name.yml
rules/application/cisco_asa___aaa_policy_tampering.yml
rules/application/cisco_asa___core_syslog_message_volume_drop.yml
rules/application/cisco_asa___device_file_copy_activity.yml
rules/application/cisco_asa___device_file_copy_to_remote_location.yml
rules/application/cisco_asa___logging_disabled_via_cli.yml
rules/application/cisco_asa___logging_filters_configuration_tampering.yml
rules/application/cisco_asa___logging_message_suppression.yml
rules/application/cisco_asa___new_local_user_account_created.yml
rules/application/cisco_asa___packet_capture_activity.yml
rules/application/cisco_asa___reconnaissance_command_activity.yml
rules/application/cisco_asa___user_account_deleted_from_local_database.yml
rules/application/cisco_asa___user_account_lockout_threshold_exceeded.yml
rules/application/cisco_asa___user_privilege_level_change.yml
rules/application/cisco_duo_admin_login_unusual_browser.yml
rules/application/cisco_duo_admin_login_unusual_country.yml
rules/application/cisco_duo_admin_login_unusual_os.yml
rules/application/cisco_duo_bulk_policy_deletion.yml
rules/application/cisco_duo_bypass_code_generation.yml
rules/application/cisco_duo_policy_allow_devices_without_screen_lock.yml
rules/application/cisco_duo_policy_allow_network_bypass_2fa.yml
rules/application/cisco_duo_policy_allow_old_flash.yml
rules/application/cisco_duo_policy_allow_old_java.yml
rules/application/cisco_duo_policy_allow_tampered_devices.yml
rules/application/cisco_duo_policy_bypass_2fa.yml
rules/application/cisco_duo_policy_deny_access.yml
rules/application/cisco_duo_policy_skip_2fa_for_other_countries.yml
rules/application/cisco_duo_set_user_status_to_bypass_2fa.yml
rules/application/cisco_ios_xe_guestshell_activation_and_destroy.yml
rules/application/cisco_ios_xe_log_clearing_sequence_with_optional_loopback_removal.yml
rules/application/cisco_ios_xe_reconnaissance_command_activity.yml
rules/application/cisco_ios_xe_remote_access_probe_burst.yml
rules/application/cisco_ios_xe_request_platform_package_describe_shell_pattern.yml
rules/application/cisco_ios_xe_tunnel_interface_configuration.yml
rules/application/cisco_ios_xe_vty_access_class_tampering.yml
rules/application/cisco_ios_xe_webui_login_from_iosd_local_port.yml
rules/application/cisco_ios_xe_webui_programmatic_configuration.yml
rules/application/cisco_sd_wan_multiple_source_ip_vmanage_admin_ssh_authentication.yml
rules/application/cisco_sd_wan_multiple_ssh_key_authentication_from_same_source.yml
rules/application/crushftp_server_side_template_injection.yml
rules/application/detect_distributed_password_spray_attempts.yml
rules/application/detect_html_help_spawn_child_process.yml
rules/application/detect_new_login_attempts_to_routers.yml
rules/application/detect_password_spray_attempts.yml
rules/application/email_attachments_with_lots_of_spaces.yml
rules/application/email_files_written_outside_of_the_outlook_directory.yml
rules/application/email_servers_sending_high_volume_traffic_to_hosts.yml
rules/application/esxi_account_modified.yml
rules/application/esxi_audit_tampering.yml
rules/application/esxi_bulk_vm_termination.yml
rules/application/esxi_download_errors.yml
rules/application/esxi_encryption_settings_modified.yml
rules/application/esxi_external_root_login_activity.yml
rules/application/esxi_firewall_disabled.yml
rules/application/esxi_lockdown_mode_disabled.yml
rules/application/esxi_loghost_config_tampering.yml
rules/application/esxi_malicious_vib_forced_install.yml
rules/application/esxi_reverse_shell_patterns.yml
rules/application/esxi_sensitive_files_accessed.yml
rules/application/esxi_shared_or_stolen_root_account.yml
rules/application/esxi_shell_access_enabled.yml
rules/application/esxi_ssh_brute_force.yml
rules/application/esxi_ssh_enabled.yml
rules/application/esxi_syslog_config_change.yml
rules/application/esxi_system_clock_manipulation.yml
rules/application/esxi_system_information_discovery.yml
rules/application/esxi_user_granted_admin_role.yml
rules/application/esxi_vib_acceptance_level_tampering.yml
rules/application/esxi_vm_discovery.yml
rules/application/esxi_vm_exported_via_remote_tool.yml
rules/application/ivanti_vtm_new_account_creation.yml
rules/application/m365_copilot_agentic_jailbreak_attack.yml
rules/application/m365_copilot_application_usage_pattern_anomalies.yml
rules/application/m365_copilot_failed_authentication_patterns.yml
rules/application/m365_copilot_impersonation_jailbreak_attack.yml
rules/application/m365_copilot_information_extraction_jailbreak_attack.yml
rules/application/m365_copilot_jailbreak_attempts.yml
rules/application/m365_copilot_non_compliant_devices_accessing_m365_copilot.yml
rules/application/m365_copilot_session_origin_anomalies.yml
rules/application/mcp_filesystem_server_suspicious_extension_write.yml
rules/application/mcp_github_suspicious_operation.yml
rules/application/mcp_postgres_suspicious_query.yml
rules/application/mcp_prompt_injection.yml
rules/application/mcp_sensitive_system_file_search.yml
rules/application/monitor_email_for_brand_abuse.yml
rules/application/no_windows_updates_in_a_time_frame.yml
rules/application/okta_authentication_failed_during_mfa_challenge.yml
rules/application/okta_idp_lifecycle_modifications.yml
rules/application/okta_mfa_exhaustion_hunt.yml
rules/application/okta_mismatch_between_source_and_response_for_verify_push_request.yml
rules/application/okta_multi_factor_authentication_disabled.yml
rules/application/okta_multiple_accounts_locked_out.yml
rules/application/okta_multiple_failed_mfa_requests_for_user.yml
... (2071 more)

Renamed Sigma rules

rules/application/ollama_abnormal_service_crash_availability_attack.yml -> rules/deprecated/ollama_abnormal_service_crash_availability_attack.yml
rules/application/ollama_possible_model_exfiltration_data_leakage.yml -> rules/deprecated/ollama_possible_model_exfiltration_data_leakage.yml
rules/application/ollama_possible_rce_via_model_loading.yml -> rules/deprecated/ollama_possible_rce_via_model_loading.yml
rules/application/ollama_suspicious_prompt_injection_jailbreak.yml -> rules/deprecated/ollama_suspicious_prompt_injection_jailbreak.yml
rules/cloud/circle_ci_disable_security_job.yml -> rules/deprecated/circle_ci_disable_security_job.yml
rules/cloud/circle_ci_disable_security_step.yml -> rules/deprecated/circle_ci_disable_security_step.yml
rules/endpoint/detection_of_tools_built_by_nirsoft.yml -> rules/deprecated/detection_of_tools_built_by_nirsoft.yml
rules/endpoint/possible_browser_pass_view_parameter.yml -> rules/deprecated/possible_browser_pass_view_parameter.yml
rules/endpoint/windows_nirsoft_advancedrun.yml -> rules/deprecated/windows_nirsoft_advancedrun.yml
rules/network/detect_large_icmp_traffic.yml -> rules/deprecated/detect_large_icmp_traffic.yml

Deleted Sigma rules

Matching detections were left in place. Remove them in this pull request if that is intended.

Deleted paths

rules/deprecated/detect_f5_tmui_rce_cve_2020_5902.yml
rules/deprecated/linux_adding_crontab_using_list_parameter.yml
rules/deprecated/lolbas_with_network_traffic.yml
rules/endpoint/child_processes_of_spoolsv_exe.yml
rules/endpoint/detect_html_help_renamed.yml
rules/endpoint/detect_mshta_renamed.yml
rules/endpoint/detect_renamed_7_zip.yml
rules/endpoint/detect_renamed_psexec.yml
rules/endpoint/detect_renamed_rclone.yml
rules/endpoint/detect_renamed_winrar.yml
rules/endpoint/detect_wmi_event_subscription_persistence.yml
rules/endpoint/macos___re_opened_applications.yml
rules/endpoint/suspicious_microsoft_workflow_compiler_rename.yml
rules/endpoint/suspicious_msbuild_rename.yml
rules/endpoint/windows_lolbas_executed_as_renamed_file.yml
rules/endpoint/windows_process_injection_into_notepad.yml
rules/endpoint/windows_regsvr32_renamed_binary.yml
rules/endpoint/windows_renamed_powershell_execution.yml
rules/endpoint/wmi_temporary_event_subscription.yml
rules/endpoint/xmrig_driver_loaded.yml

Checklist

• CI/CD jobs passed
• Validated SPL logic
• Validated tags, description, and how to implement
• Verified references match analytic