Sigma detection rules, expert-reviewed

Suspicious GCP Log Sink Tampering for Defense Evasion (via gcp)

This rule detects Google Cloud audit-log operations that update, disable, or delete logging sinks and buckets, a defense-evasion tactic used to blind visibility during cloud attacks. Adversaries suppress log export so their subsequent actions are not recorded.

Malicious S3 Object Encryption for Ransom via SSE-C

This rule detects an S3 PutObject call that supplies a customer provided encryption key using server side encryption with customer keys, the core primitive of the AWS S3 SSE-C ransom scenario emulated by Elastic. By overwriting objects with a key only the attacker holds the adversary makes bucket data unrecoverable to the owner and demands payment. SSE-C on writes is uncommon in most environments and can indicate destructive ransom activity.

Suspicious UNC3944 Rogue Federated Identity Provider Added to Entra Tenant (via azure)

This rule detects Azure AD/Entra directory operations that configure or modify domain federation settings, which adds or alters a trusted identity provider. UNC3944 abused hybrid identity by registering a rogue federated IdP to forge SAML tokens and impersonate any user in the tenant. Unexpected federation trust changes are a high-value indicator of a Golden SAML style backdoor.

Suspicious AWS STS Session Token and Role Chaining Abuse via CloudTrail (via aws)

This rule surfaces AWS STS GetSessionToken and AssumeRole activity that adversaries abuse to mint temporary credentials and chain roles for lateral movement, as detailed in Red Canary's analysis of AWS cloud account abuse. Because these APIs are also used legitimately, alerts should be correlated with the calling identity and source to spot role chaining that escalates access across the environment.

Suspicious OAuth Application Registration with Localhost Reply URL via Azure AD

This rule detects registration or update of an Azure AD OAuth application whose reply or redirect URL points to an anomalous localhost loopback endpoint such as http://localhost:7823/access/. This behavior was observed in OAuth application attacks researched by Huntress where adversaries register illicit applications to harvest tokens. Attackers abuse consented OAuth apps to maintain persistent access to cloud mailboxes and data, so anomalous reply URLs are a strong early indicator of illicit app registration.

Possible Rogue Device Registration in Entra ID After Device Code Phishing

This rule detects registration of a new device in Entra ID which commonly follows successful device-code phishing. In the Dangerous Invitations campaign the Russian actor registered attacker-controlled devices to obtain durable access after luring targets with spoofed European security event invitations. Adding a rogue device is a stealthy persistence mechanism that can bypass conditional access and sustain access to the tenant.

Suspicious Bedrock AgentCore Runtime Invocation on Wildcard Resources (via aws)

This rule detects Bedrock AgentCore code interpreter and agent runtime invocations that, in the Agent God Mode scenario, are abused through wildcard IAM permissions to execute code across agent boundaries. Invocation of these runtimes by unexpected principals can indicate exploitation of excessive privileges for arbitrary execution in the AI environment.

Suspicious AWS SAML Provider Enumeration for Federation Recon (via cloudtrail)

This rule detects enumeration of configured SAML identity providers through the IAM ListSAMLProviders call, a discovery step Muddled Libra performs to understand federation and plan cross tenant identity abuse. Because this API is rarely called in day to day operations, its use by an interactive or unfamiliar principal points to adversary reconnaissance of the trust configuration.

Malicious Azure Deletion of Resource Locks and Immutability Policies

This rule detects deletion of Azure resource locks and blob immutability policies, an anti-recovery step preceding storage ransomware. Removing locks and immutability protections strips the guardrails that would otherwise prevent an actor from overwriting or destroying blob data. A burst of these delete operations on storage resources indicates preparation for data destruction or ransom.

Suspicious SNS Email Subscription for Data Exfiltration

This rule detects an SNS Subscribe call using the email protocol, an exfiltration setup step in the AWS SNS abuse scenario researched by Elastic. Attackers subscribe an external email address to a topic then publish stolen credentials or data to it over a trusted AWS channel. Email subscriptions created by unexpected principals should be reviewed for data theft.

Suspicious Teams Message Soft Delete by Agent Identity via M365 Audit

This rule detects soft deletion of Teams channel messages, the cleanup step observed when a compromised Entra agent identity posts internal phishing links and then removes the evidence. Adversaries delete their own messages to hide internal spearphishing and slow investigation, so agent-driven message deletions in Teams warrant correlation with preceding message-send activity.

Malicious Storm-0558 Forged Token Sign-In from MSA Consumer Tenant (via azure signinlogs)

This rule detects Entra ID sign-ins whose home tenant is the Microsoft consumer MSA tenant 9188040d-6c67-4c5b-b112-36a304b66dad, the issuer Storm-0558 impersonated with a stolen MSA signing key to forge OpenID v2.0 tokens against Exchange Online and other organizational resources. Tokens minted for enterprise access from this consumer issuer indicate forged-credential authentication and should be treated as identity compromise.

Malicious S3 Object Encryption with Customer Provided Key via CopyObject

This rule detects S3 CopyObject or PutObject API calls that supply a customer provided SSE-C encryption key which is the technique used in the CopyObjection intrusion to encrypt a victim S3 bucket for ransom. Because the attacker holds the key AWS cannot recover the data making this a destructive extortion action. Detecting SSE-C on bulk object operations surfaces ransomware activity in cloud storage.

Suspicious Azure OpenAI Training File Upload via Files Import Operation (via azure)

This rule detects the Azure OpenAI Files_Import and Files_Upload operations in diagnostic logs, the behavior Red Canary linked to model poisoning and data staging where an actor uploads fine-tuning files to an OpenAI resource. Unexpected file uploads to an Azure OpenAI deployment can indicate poisoning of training data or staging for later exfiltration.

Suspicious Credential Added to Existing Application for OAuth Persistence in Entra ID (via azure auditlogs)

This rule detects Entra ID audit events that add certificates or secrets to an existing application registration, the technique SolarWinds actors used to inject their own credentials into trusted OAuth apps for durable cloud access. New credentials on established applications can let an attacker authenticate as that service principal, so these changes should be reviewed as potential persistence.