Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
314 rules
Azure Audit Logs: Privileged Account Creation via Admin Role Assignment
Flags successful events where a user is added and added to a role, indicating new admin account creation in Azure.
Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H', Tim Shelton, Huntrule TeamAzureauditlogsMedium141Free2022-08-11Azure AD Account Created and Deleted Shortly After Creation (Audit Logs)
Identifies successful Azure user creation and deletion in quick succession, consistent with short-lived account activity.
Mark Morowczynski '@markmorow', MikeDuddington, '@dudders1', Tim Shelton, Huntrule TeamAzureauditlogsHigh172Free2022-08-11Azure Entra Audit Logs: Temporary Access Pass Method Added to an Account
Flags admin registration of a temporary access pass method in Azure audit logs for user accounts.
Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H', Huntrule TeamAzureauditlogsHigh3910Free2022-08-10Azure Entra: Guest User Invitation Failed When Initiated by Non-Privileged User
Identifies failed guest user invitations in Azure audit logs when the inviter lacks required permissions.
Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H', Huntrule TeamAzureauditlogsMedium123Free2022-08-10Azure Entra PIM Role Setting Changes in Audit Logs
Alerts on Azure PIM role setting update events recorded in audit logs.
Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H', Huntrule TeamAzureauditlogsHigh173Free2022-08-09Azure PIM Alert Setting Disabled (Audit Log Message Detection)
Flags Azure audit log events where PIM alerts are disabled (message: "Disable PIM Alert").
Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H', Huntrule TeamAzureauditlogsHigh375Free2022-08-09Azure PIM Approval or Denial Recorded in Audit Logs
Flags Azure PIM elevation requests that are approved or denied in audit logs for investigation.
Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H', Huntrule TeamAzureauditlogsHigh164Free2022-08-09Azure Audit Logs: User Added to Privileged Eligibility Role
Alerts on Azure audit log events indicating a user was added as an eligible or permanent member to a privileged role.
Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H', Huntrule TeamAzureauditlogsHigh132Free2022-08-06Azure Audit Logs: Removal of Privileged Role Eligible Members
Flags Azure audit log events indicating bulk removal of eligible members from privileged roles.
Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H', Huntrule TeamAzureauditlogsHigh175Free2022-08-05Azure AD: Detect Removal From Group With Conditional Access Policy Modification Rights
Alerts when a user is removed from a group that can modify Conditional Access policies in Azure Entra.
Mark Morowczynski '@markmorow', Thomas Detzner '@tdetzner', Huntrule TeamAzureauditlogsMedium101Free2022-08-04Azure Entra: Added member to group granting Conditional Access policy modification
Alerts when a user is added to a group that can modify Conditional Access policies in Azure Entra ID.
Mark Morowczynski '@markmorow', Thomas Detzner '@tdetzner', Huntrule TeamAzureauditlogsMedium102Free2022-08-04Azure AD audit logs: Successful user-initiated password reset
Alerts on successful Azure AD password reset events initiated by a user account.
YochanaHenderson, '@Yochana-H', Huntrule TeamAzureauditlogsMedium121Free2022-08-03Azure Audit Logs: Admin-initiated App Role Assignments and Privileged Delegated Permissions
Alerts on Azure audit events where an admin grants app roles to a service principal, enabling privileged application access.
Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow', Huntrule TeamAzureauditlogsHigh90Free2022-07-28Azure Audit Logs: End User Consent for Application (Non-Admin Consent)
Identifies end-user consent grants to applications in Azure AD audit logs.
Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow', Huntrule TeamAzureauditlogsLow135Free2022-07-28Azure audit logs: Delegated highly privileged permissions granted for all users
Alerts on Azure audit log events where delegated permissions are granted to all users.
Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow', Huntrule TeamAzureauditlogsHigh90Free2022-07-28