Sigma detection rules, expert-reviewed

Malicious Office 365 Email Forwarding Rule to External Domain (via office365)

This rule detects creates a forwarding rules to a non company email in order to collect information.

Suspicious AWS Secrets Manager Bulk Secret Retrieval via BatchGetSecretValue

This rule detects the AWS Secrets Manager BatchGetSecretValue API which returns multiple secret values in a single call. Wiz observed attackers accessing stored secrets after compromising cloud credentials during hybrid cloud intrusions. This is important because bulk secret retrieval is a common credential-access step that harvests database passwords and API keys enabling deeper movement across cloud and on-prem systems.

Suspicious IAM Policy Attachment Granting AdministratorAccess

This rule detects an AttachUserPolicy call that attaches the AWS managed AdministratorAccess policy to an IAM user. After compromising an EC2 instance and stealing IMDS credentials the attacker created a rogue IAM user and granted it full administrator rights for persistence and privilege escalation. Sudden attachment of AdministratorAccess to a user is high-signal for cloud account takeover.

Malicious Active Directory Federated Trust Added (via office365)

This rule detects scenarios where an federated trust is added by an attacker.

Suspicious AWS SSO Token Creation and Role Credential Retrieval (via cloudtrail)

This rule detects the AWS SSO CreateToken and GetRoleCredentials calls against sso.amazonaws.com, the API sequence Red Canary described adversaries using to replay cached SSO tokens stolen from the .aws sso cache. When these calls originate from multiple IP addresses in a short window they indicate an actor exchanging a stolen access token for STS role credentials.

Suspicious Mail Send via Microsoft Graph by Application Identity via M365 Audit

This rule detects mail sent through the Microsoft Graph sendMail action by an application or agent identity, the delivery step an attacker uses after hijacking an Entra assistive agent to send internal spearphishing. Because agents that gain send-mail access can distribute malicious links from a trusted internal identity, Graph-driven mail sends attributed to service principals should be reviewed against recent consent grants.

Suspicious Credential Added to Application or Service Principal in Entra ID (via azure)

This rule detects new password or certificate credentials being added to an Entra ID application or service principal, the persistence technique Silk Typhoon uses to abuse OAuth applications and service principals holding administrative permissions. Adversaries append their own secrets to trusted applications to authenticate as the app and access mail, OneDrive, and SharePoint through MSGraph, so unexpected credential additions signal a supply-chain identity compromise.

Suspicious OAuth Consent Grant to Mail Access Permissions via Azure AD

This rule detects OAuth application consent grants that request mailbox read/send and offline access scopes in Azure AD audit logs. This aligns with the Huntress traitorware campaign where adversaries consent legitimate mail clients to gain persistent mailbox access, letting them read and send mail via issued tokens without touching the password.

Suspicious AWS STS Role Chaining From Temporary Session Credentials (via cloudtrail)

This rule detects an AWS STS AssumeRole call whose caller is already an assumed-role session, the role chaining pattern attackers use to mint successive ASIA temporary credentials and persist beyond a single session expiry. Chained AssumeRole invocations extend stolen access and evade credential lifetime controls. Detecting assumed-role principals assuming further roles surfaces this persistence technique.

Malicious Azure Storage and Compute Destruction via Key Listing and Snapshot Deletion

This rule detects Azure operations that list storage account keys and delete storage or compute snapshots. Microsoft observed Storm-0501 combining these to exfiltrate then destroy cloud data and backups for extortion. Bulk key retrieval followed by resource and snapshot deletion is destructive impact activity, so these operations should be treated as a possible cloud ransomware event.

Suspicious Member Added to Privileged Directory Role in Entra ID

This rule detects Entra ID audit events adding a member to a directory role such as Global Administrator. Wiz Research observed Midnight Blizzard elevating principals into privileged roles to broaden access, so unexpected role membership changes can indicate an account manipulation and privilege escalation attempt.

Suspicious High-Privilege Microsoft Graph Application Role Grant via Azure Audit (via azure)

This rule detects the assignment of high-privilege Microsoft Graph application roles such as AppRoleAssignment.ReadWrite.All, Directory.ReadWrite.All, or RoleManagement.ReadWrite.Directory to a service principal, an escalation path into Azure highlighted by Red Canary. Granting these permissions lets an app rewrite directory roles and grant itself further access, making it a powerful and stealthy persistence mechanism that should be tightly controlled.

Suspicious SNS Publish to Phone Number for Smishing

This rule detects an SNS Publish call that targets a phone number directly, a smishing abuse pattern in the AWS SNS research by Elastic. Adversaries who compromise credentials use SNS to send SMS phishing messages at scale from the victim account. Direct phone number publishes outside of known messaging workflows can indicate account abuse and outbound phishing.

Suspicious AWS SES Production Access Request via PutAccountDetails (Cloud Email Abuse)

This rule detects SES PutAccountDetails CloudTrail events that request production sending access to escape the SES sandbox, a burst of which was central to the cloud email service takeover campaign. It matters because attackers using leaked keys raise sending limits before launching large phishing campaigns.

GCP Google Workspace: Alert on Suspicious Login Classifications

Alerts on Google Workspace login audit events classified by Google as suspicious, including less secure app and programmatic login types.