Sigma detection rules, expert-reviewed

Suspicious AWS GetFederationToken Console Access by JavaGhost (via cloudtrail)

This rule detects use of the STS GetFederationToken API, which JavaGhost abuses to mint federated console sign-in sessions from stolen long-term IAM credentials. Generating console access via federation lets the actor operate interactively in the AWS account while blending with legitimate application-token usage.

Suspicious Azure VM Extension Write for Credential Reset via Activity Log

This rule detects Azure Compute virtual machine extension write operations, the activity abused by the VMAccess password reset technique where an attacker supplies an arbitrary caller-controlled extension name to evade name-based detections. Adversaries use this to reset local credentials and gain persistent access to a VM. Unexpected extension writes on sensitive machines should be reviewed as account manipulation.

Suspicious Exchange Online Mail Flow Rule or Connector Creation via Compromised Account

This rule detects creation or modification of Exchange Online transport rules, inbound connectors, or DKIM signing configuration, matching post-compromise mailbox tampering observed in the Kali365 device code phishing ecosystem. Adversaries add mail flow rules and connectors to reroute, hide, or spoof mail after taking over an account. These mailbox-infrastructure changes support business email compromise and mass phishing distribution.

Suspicious AWS EC2 Windows Password Retrieval via GetPasswordData

This rule detects use of the EC2 GetPasswordData API which returns the encrypted local administrator password for a Windows instance. In the Wiz hybrid cloud response case an attacker with stolen AWS credentials called GetPasswordData to recover local admin passwords and pivot onto EC2 hosts. This is important because password retrieval across instances is a strong precursor to interactive host access and lateral movement into the compute layer.

Suspicious Boto3 Kali Linux User Agent in AWS CloudTrail Reconnaissance (via cloudtrail)

This rule detects AWS CloudTrail activity from the specific Boto3 1.42.73 build running on Kali Linux that TeamPCP used to enumerate IAM EC2 Lambda and Secrets Manager resources after stealing credentials. The pairing of this SDK version with a Kali offensive distribution user agent is a strong indicator of hands-on-keyboard cloud reconnaissance with stolen keys.

Malicious Cloud Storage Destruction by Cloud Build Service Account

This rule detects a Google Cloud Build default service account invoking storage bucket or object deletion which was abused to destroy data by triggering builds that ran attacker controlled steps. Destructive storage operations originating from a cloudbuild or compute default service account rather than a human principal indicate potential data destruction through the Cloud Build pipeline.

Suspicious AWS IAM User Creation Using Support Impersonation Name

This rule detects the creation of an AWS IAM user named aws_support which the TeamTNT Doppelganger campaign creates and grants administrative permissions to in order to establish a persistent privileged foothold disguised as a legitimate AWS support account.

Suspicious IAM CreateLoginProfile For Root User via AWS AssumeRoot Abuse

This rule detects an IAM CreateLoginProfile event that establishes console access for the root user which follows abuse of STS AssumeRoot to plant durable access in a member account. Adversaries create a root login profile to convert temporary root credentials into persistent account takeover.

Malicious Directory Enumeration With Recon Tooling User Agent via Azure AD Graph

This rule detects Azure AD Graph requests carrying user agents belonging to known enumeration frameworks such as AzureHound BloodHound and AADInternals as described in Elastic research on AAD Graph activity logs. These tool signatures against the legacy Graph service indicate active directory reconnaissance for privilege escalation paths.

Suspicious Entra Device Code Authentication with Office Client and Automated User Agent

This rule detects Entra ID sign-ins using the device code authentication flow against the Microsoft Office client application from an automated python-requests user agent, matching the Kali365 device code phishing ecosystem. Adversaries phish device codes to obtain refresh tokens for the well-known Office client and replay them programmatically to access mailboxes. Device code flow paired with a scripted user agent is a strong indicator of token theft and mailbox compromise.

Suspicious GCP Bucket Deletion for Namespace Hijacking (via gcp)

This rule detects GCP storage bucket deletion operations that enable universal bucket hijacking, where an attacker recreates a same-named bucket in another account to intercept data. This tactic redirects storage transfer, pubsub, and logging outputs to adversary-controlled resources.

Suspicious AWS IAM Privilege Escalation via AttachUserPolicy of Administrator Policy

This rule detects an IAM AttachUserPolicy call that attaches an administrator managed policy to a user, a technique used by operators of exposed IAM keys tracked by Unit 42 to escalate privileges before launching cryptojacking instances. Attackers abuse leaked long-term keys to grant themselves full control of the account which enables large scale resource abuse.

Suspicious Azure NSG Rule Opening SSH to the Internet

This rule detects creation or modification of a Network Security Group rule that exposes SSH port 22 to any source address, the network-backdoor action performed in the Azure Fabric intrusion to enable inbound remote access. Opening management ports to 0.0.0.0/0 is a high-risk change and a common cloud persistence step.

Malicious EKS Access Policy Association Granting Cluster Admin

This rule detects CloudTrail AssociateAccessPolicy events that attach the AmazonEKSClusterAdminPolicy or AmazonEKSAdminPolicy to an EKS access entry. Wiz Research showed this new access management API can be abused to grant an attacker principal cluster administrator rights, so unexpected admin grants should be treated as potential privilege escalation.

Suspicious Retrieval of AWS Secrets Manager Values (via cloudtrail)

This rule detects GetSecretValue and BatchGetSecretValue calls against Secrets Manager, a credentials-from-cloud-stores technique used to harvest database passwords, API keys and tokens after gaining access to an AWS account. Cloud secret-store access is tracked in the Red Canary Threat Detection Report cloud coverage. Detecting these reads surfaces bulk secret harvesting.