Sigma detection rules, expert-reviewed

Suspicious STS AssumeRole With Exfil Session Name via CloudTrail (via cloudtrail)

This rule detects the Shai Hulud actor assuming high privilege roles using session names that begin with exfil such as exfil, exfil10 and exfil12 to run Systems Manager commands and read data. Operator chosen session names that reveal exfiltration intent are a strong hunting signal. These sessions preceded Redshift data theft.

Suspicious AWS SAML Identity Provider Creation

This rule detects creation of a SAML identity provider through the IAM CreateSAMLProvider call. Adversaries register a rogue federation provider to establish durable authenticated access to the account, a persistence and account manipulation technique highlighted by Sekoia AWS detection guidance.

AWS Bedrock Guardrail Updated via UpdateGuardrail API

Alerts on CloudTrail-reported Amazon Bedrock guardrail updates, which may signal attempts to weaken safety controls.

AWS Bedrock Guardrail Deletion via CloudTrail DeleteGuardrail API

Alerts on CloudTrail DeleteGuardrail events indicating an AWS Bedrock guardrail was removed.

Suspicious Entra Agent Service Principal Sign-In With PowerShell User Agent via Sign-In Logs

This rule detects a service principal sign-in using a PowerShell user agent against Entra Agent ID identities, a pattern of automated credential misuse where an attacker authenticates as an AI agent through scripted Graph calls. Because assigned agents normally authenticate through their own runtime rather than interactive PowerShell tooling, this user agent on service principal sign-ins indicates hands-on-keyboard abuse of agent credentials.

Suspicious Entra ID Auth Broker Sign-In With Node.js User Agent via Tycoon 2FA

This rule detects Entra ID sign ins against the Microsoft Authentication Broker application from Node.js based clients such as axios undici and node-fetch as characteristic of Tycoon 2FA adversary in the middle attacks in Elastic research. Automated Node runtimes replaying stolen tokens through the Auth Broker indicate token theft and primary refresh token abuse rather than genuine user interaction.

Suspicious Inbox Rule Moving Mail to Junk for Concealment (via m365)

This rule detects creation or modification of a mailbox inbox rule that moves incoming messages to the junk email folder. Threat actors created such rules to hide fraud notifications and security alerts from the victim while automating financially driven attacks.

Suspicious AWS Organizations and Account Discovery via aws (via cloudtrail)

This rule detects AWS Organizations and account enumeration API calls that map the blast radius of compromised access keys. Unit 42 observed this cloud service discovery during the SugarCRM incident where stolen credentials were used to survey the target environment before resource abuse, so alerting is warranted when these calls come from unexpected principals.

Suspicious AWS Console Login Without MFA

This rule detects a successful AWS Management Console sign-in where additionalEventData.MFAUsed is No, indicating interactive access with only a password or root credentials and no second factor. Adversaries who compromise console credentials rely on non-MFA logins to gain hands-on-keyboard access, a pattern GuardDuty also flags as IAMUser ConsoleLoginSuccess. This is important because non-MFA console logins are a primary indicator of account takeover.

Suspicious Spoofed Inbound Email With Failed Authentication and Anonymous Internal Sender (via m365)

This rule detects inbound messages that fail SPF, DKIM, and composite authentication yet are marked as internal organization senders while authenticating anonymously. This combination reflects the routing and misconfiguration abuse used by phishing actors to spoof trusted internal domains and bypass tenant protections. Detecting the mismatch between claimed internal origin and failed authentication surfaces domain-spoofing phishing that would otherwise appear trustworthy to recipients.

Suspicious Cloud Sign-In From an Anonymizer or High-Risk Session (via signinlogs)

This rule detects an Entra ID sign-in flagged with an anonymized IP address or a high real-time risk level, indicating access through Tor or a VPN anonymizer or from a session Microsoft's risk engine deems likely compromised. Compromise of cloud accounts is the most prevalent technique in the Red Canary Threat Detection Report. Detecting anonymized and high-risk sign-ins surfaces suspicious identity access at the authentication boundary.

Suspicious Entra Sign-In to OfficeHome with axios User Agent

This rule detects a successful Entra ID sign-in to the OfficeHome application where the user agent contains axios, an automation library used by the Tycoon 2FA adversary-in-the-middle platform. Tycoon 2FA relayed intercepted credentials and stolen session cookies through scripted axios clients to authenticate as the victim. A non-browser axios agent completing sign-in to OfficeHome indicates automated session token replay from an AiTM phishing kit.

Suspicious AWS CloudTrail Logging Disabled

This rule detects API calls that stop or delete AWS logging such as StopLogging, DeleteTrail and DeleteFlowLogs. Adversaries disable CloudTrail and VPC flow logs to blind defenders before carrying out further actions, a defense evasion step that should be rare and deliberate.

Suspicious Delegated Permission Grant to Entra Agent Access Scope via Azure Audit Logs

This rule detects a delegated permission grant that targets an Entra agent blueprint access_agent scope, the consent step that lets an attacker-controlled app drive an assistive AI agent. Adversaries obtain delegated access to agents that can send mail and act on the user behalf, so a grant referencing access_agent indicates agent hijacking through illicit consent.

Suspicious Entra Sign-In Interrupt With High Aggregated Risk via AiTM DNS Hijacking (via azure)

This rule surfaces Microsoft Entra sign-ins carrying a high aggregated risk score alongside interrupt or success result codes, the pattern seen when SOHO router DNS hijacking redirects victims through an adversary-in-the-middle proxy that replays authentication. Adversaries use the hijacked DNS to intercept credentials and tokens, so high-risk sign-ins clustered with these result codes warrant investigation for token theft and mailbox access.