Sigma detection rules, expert-reviewed

Malicious AWS Cross-Account AssumeRole With Suspicious Session Names via CloudTrail (via aws)

This rule detects AWS STS AssumeRole calls that use session names tied to an AI assisted intrusion which escalated to administrator access. The operators assumed the organization account access role with session names such as pwned escalation and claude-session while pivoting across accounts. Role session names of this kind indicate hands on keyboard privilege escalation.

Suspicious AWS EC2 Serial Console Access Enabled via Scattered Spider Technique

This rule detects the AWS API call EnableSerialConsoleAccess which turns on account wide EC2 serial console access. Scattered Spider style intruders enable this to obtain out of band shell access to instances and bypass network and SSH controls. Because enabling serial console access is rare in normal operations it is a strong signal of hands on keyboard abuse.

Suspicious AWS GuardDuty Detector Tampering

This rule detects tampering with AWS GuardDuty through DeleteDetector, UpdateDetector or CreateIPSet operations. Attackers disable the detector or add trusted IP allowlists so their activity is no longer flagged, undermining threat detection in the account.

Malicious Business Email Compromise OAuth Application Sign-In via Entra ID Service Principal (via azure)

This rule detects Entra ID sign-ins tied to the PerfectData Software and eM Client OAuth application identifiers that Red Canary observed adversaries abusing to gain persistent mailbox access during business email compromise schemes. Attackers consent these third-party mail applications into a compromised tenant so they can read and exfiltrate mail through issued tokens without the victim password, making any sign-in with these application IDs a strong compromise indicator.

Suspicious AWS GetCallerIdentity From TruffleHog User Agent via Cloudtrail

This rule detects AWS STS GetCallerIdentity calls carrying a TruffleHog user agent, a validation step the Shai-Hulud worm performs against stolen access keys before exfiltration. Attackers confirm harvested cloud credentials are valid prior to abuse, so TruffleHog-attributed API activity in production accounts indicates credential theft and reconnaissance.

Malicious Mass Device Wipe via Intune Remote Actions (via m365)

This rule detects Intune remote wipe and factory reset actions in Microsoft 365 audit logs, a destructive technique associated with Handala-linked wiper operations that abuse device management to erase endpoints at scale. Mass remote wipe actions cause widespread data and availability loss, so such events outside authorized decommissioning should be investigated urgently.

Possible Public Bucket IAM Binding for Data Exfiltration (via gcp)

This rule detects GCP IAM policy changes that grant the allAuthenticatedUsers or allUsers principals object-creator access on storage buckets, exposing them to universal write. Attackers abuse this global-namespace binding to hijack buckets and stage cloud data exfiltration.

Malicious AzureHound Cloud Reconnaissance via User Agent (via azure)

This rule detects sign-ins and Graph API activity carrying the azurehound user-agent string, indicating use of the AzureHound collector to enumerate users, groups, roles, and service principals. Threat actors run AzureHound to map Azure and Entra ID attack paths before privilege escalation. Detecting the tool user-agent exposes cloud discovery activity at its source identity.

Suspicious CloudTrail Logging Tampering for Defense Evasion (via aws)

This rule detects AWS CloudTrail API calls that stop, delete, or reconfigure trails, including KMS key swaps and redirection to attacker-controlled S3 buckets. Adversaries perform these actions to blind logging and evade detection during cloud intrusions.

Malicious IAM Group Creation for SES Abuse by JavaGhost (via cloudtrail)

This rule detects creation of the IAM group AWSSESSendingGroupDoNotRename, a persistence artifact JavaGhost creates to grant SES email-sending permissions for phishing. The deceptively official group name is used to authorize continued abuse of Simple Email Service from the victim account.

Malicious JavaGhost Security Group Creation (via cloudtrail)

This rule detects creation of EC2 security groups named Java_Ghost or bearing the description We Are There But Not Visible, calling cards left by the JavaGhost actor in compromised AWS environments. These empty security groups act as a signature the group plants during its cloud phishing operations.

Malicious Administrator Policy Attachment for Privilege Escalation in AWS

This rule detects the AdministratorAccess managed policy being attached to a role or user through AttachRolePolicy or AttachUserPolicy, a privilege escalation step in the large-scale cloud extortion operation that leveraged leaked environment variables. Granting full admin to a controlled identity gives the actor complete account control. Detecting this exposes escalation ahead of data theft and extortion.

Malicious Cloud Attack Tooling User Agent in CloudTrail via aws (via cloudtrail)

This rule detects AWS CloudTrail activity originating from the Pacu and ScoutSuite offensive cloud toolkits identified by their user agent strings. These frameworks were used to enumerate and abuse AWS control-plane access after ~/.aws/credentials theft during the SugarCRM zero-day cloud intrusion, indicating an attacker performing hands-on-keyboard cloud reconnaissance and resource abuse.

Malicious Inbox Rule Hiding Security Mail to RSS Feeds via M365 (via m365)

This rule detects creation of an Exchange Online inbox rule that moves messages into the RSS Feeds folder and marks them as read. This is a common business email compromise technique to hide security notifications and replies from the compromised user. Concealing warning mail lets the attacker operate the mailbox and pursue fraud undetected.

Malicious Exchange Inbox Rule Hiding Direct Deposit and Bank Emails via Payroll Pirate Compromise (via m365)

This rule detects Exchange Online inbox rules that move or delete messages mentioning direct deposit, bank, or payroll, an email-hiding technique used by Storm-2755 to conceal payroll change alerts from compromised Canadian employees. Adversaries suppress these notifications so their rerouting of salary payments goes unnoticed, making inbox rules keyed on payment keywords a high-confidence sign of payroll fraud.