Sigma detection rules, expert-reviewed

Suspicious Microsoft Entra Device Code Authentication Flow

This rule detects sign-ins that complete through the OAuth device code authentication protocol in Microsoft Entra. The EvilTokens phishing-as-a-service kit abuses the device code flow to trick victims into authorising attacker controlled devices and harvest refresh tokens. Because device code is uncommon for ordinary interactive users its appearance should be reviewed against expected device enrollment activity.

Suspicious M365 Password Spraying via Azure PowerShell AppId from Quad7 Botnet

This rule detects Microsoft 365 sign-in attempts using the Azure PowerShell application id 1950a258-227b-4e31-a9cf-717495945fc2 against the Microsoft Graph resource identity, the combination the Quad7 botnet relies on for distributed password spraying. The operators relay authentication through compromised SOHO routers to validate stolen credentials at scale. Clustering on this AppId and resource surfaces the brute force activity for review.

Suspicious S3 Bucket Replication Configured via Scattered Spider Exfiltration Technique

This rule detects the AWS S3 API call PutBucketReplication which configures automatic replication of bucket objects to another bucket. Scattered Spider style actors abuse replication to silently copy sensitive data to an attacker controlled destination for exfiltration. Unexpected replication configuration on data buckets warrants immediate review.

Suspicious Route53 Domain Transfer Lock Disabled via Scattered Spider Technique

This rule detects the AWS Route53 Domains API call DisableDomainTransferLock which removes the safeguard preventing a registered domain from being transferred away. Scattered Spider style actors disable this lock to hijack domains for phishing or to disrupt the victim. This administrative action is uncommon and should be verified against change management.

Suspicious AWS EC2 Serial Console Access Enabled via Scattered Spider Technique

This rule detects the AWS API call EnableSerialConsoleAccess which turns on account wide EC2 serial console access. Scattered Spider style intruders enable this to obtain out of band shell access to instances and bypass network and SSH controls. Because enabling serial console access is rare in normal operations it is a strong signal of hands on keyboard abuse.

Suspicious AWS Instance Access or Export via SSH Key or Export Task

This rule detects SendSSHPublicKey and CreateInstanceExportTask operations used to gain interactive access to or exfiltrate EC2 instances. Pushing a temporary SSH key via EC2 Instance Connect or exporting an instance image lets an attacker reach or copy workloads outside normal channels.

Suspicious AWS GuardDuty Detector Tampering

This rule detects tampering with AWS GuardDuty through DeleteDetector, UpdateDetector or CreateIPSet operations. Attackers disable the detector or add trusted IP allowlists so their activity is no longer flagged, undermining threat detection in the account.

Suspicious Inbox Rule Creation That Deletes Incoming Mail via Exchange (via m365)

This rule detects the creation or modification of Exchange inbox rules that silently delete or hide incoming mail, a technique used in the back-to-school email account compromise campaign reported by Red Canary. Adversaries who take over an educational mailbox create hidden rules with obscure names to auto-delete replies and warnings while they conduct internal spearphishing, and this activity should be reviewed to catch account takeover before it spreads.

Suspicious Federated Identity Credential On-Behalf-Of Token Flow via Sign-In Logs

This rule detects token requests using the user_fic grant type against a federated identity credential, the on-behalf-of flow abused to let a compromised Entra agent act as a user without a stored secret. Attackers leverage federated identity credentials to obtain user-context tokens for AI agents and pivot into mailboxes and Teams, so this grant type is a strong signal of agent identity abuse.

Suspicious Credential Addition to Entra Application via Azure Audit Logs

This rule detects a new password or certificate being added to an Entra application or agent blueprint, corresponding to the addPassword call used to hijack AI agent identities. Attackers attach their own credentials to an existing app registration to obtain long-lived authentication as that identity, so unexpected secret additions indicate service principal credential abuse and persistence.

Suspicious Service Principal Creation via Azure Audit Logs

This rule detects creation of a new service principal in Entra ID, an action attackers perform after illicit OAuth consent to register their own application identity for persistent tenant access. Newly added service principals with broad Graph scopes can read mail and files and move through cloud resources, making unexpected additions a meaningful signal of account or app abuse.

Suspicious OAuth Application Consent Grant via Azure Audit Logs

This rule detects user or admin consent granted to an OAuth application in Entra ID, the pivot point in illicit consent phishing campaigns where victims authorize attacker-controlled apps requesting sensitive Graph permissions. Adversaries use consented apps to read mail and files and to establish durable API access that survives password resets, so unexpected consent events warrant review.

Suspicious Azure OpenAI Model Enumeration and Deployment Creation (via azure)

This rule detects the Azure OpenAI Models_List and Deployments_Create operations that Red Canary described adversaries using to enumerate available models and stand up new deployments after obtaining access to a resource. Reconnaissance of models followed by deployment creation can indicate an actor preparing to abuse a victim Azure OpenAI service for inference at the owner expense.

Suspicious Azure Cognitive Services Account Key Enumeration via ListKeys (via azure)

This rule detects the Cognitive Services ListKeys action in Azure activity logs, the API-key retrieval step Red Canary observed adversaries using to obtain persistent Azure OpenAI credentials. Because the returned key does not expire unless regenerated, unexpected ListKeys calls against a Cognitive Services account can indicate an actor acquiring durable access for later model abuse.

Suspicious Entra ID Application Consent Failure Indicating Unauthorized OAuth Grant Attempt (via azure)

This rule detects Entra ID sign-in failures carrying error codes 65001 and 90095 which represent an unapproved application consent attempt and a denied admin-consent request. Red Canary observed adversaries triggering these consent errors while trying to authorize rogue OAuth applications for mailbox access in business email compromise schemes, so a cluster of these failures can reveal an in-progress service principal abuse attempt.