Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
314 rules
Azure AD Sign-in Success Without MFA (Single-Factor Authentication)
Alerts on successful Azure AD sign-ins where MFA was not required and only single-factor authentication was used.
MikeDuddington, '@dudders1', Huntrule TeamAzuresigninlogsLow90Free2022-07-27Azure App/Service Principal Assigned to Entra ID or Azure RBAC Roles (Audit Logs)
Finds Azure role assignments where an app/service principal is granted, eligible, or scoped membership via audit log messages.
Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow', Huntrule TeamAzureauditlogsMedium174Free2022-07-19Azure Entra conditional access policy updated by non-approved actor
Alerts when an Azure Entra Conditional Access policy update occurs, indicating access control changes by an actor outside the approved set.
Corissa Koopmans, '@corissalea', Huntrule TeamAzureauditlogsMedium71Free2022-07-19Azure Entra Conditional Access Policy Deleted by Non-Approved Actor
Flags Azure audit log events where a conditional access policy is deleted.
Corissa Koopmans, '@corissalea', Huntrule TeamAzureauditlogsMedium359Free2022-07-19Azure Conditional Access Policy Added by Non-approved Actor
Alerts on Azure audit log events indicating a Conditional Access policy was added.
Corissa Koopmans, '@corissalea', Huntrule TeamAzureauditlogsMedium123Free2022-07-18Azure Audit Logs: App Granted Microsoft Graph/Exchange/SharePoint/Azure AD Permissions
Alerts on Azure AD audit log entries where an app/service principal is granted delegated or app-role permissions to Microsoft services.
Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow', Huntrule TeamAzureauditlogsHigh100Free2022-07-10Azure AD End-User Consent Blocked for Risk-Based Risky App Exceptions
Alerts when Azure end-user consent is blocked due to risk-based consent for risky apps.
Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow', Huntrule TeamAzureauditlogsMedium135Free2022-07-10Azure Audit Logs: UserType updated from Guest to Member
Alerts when an Azure user’s UserType is updated from Guest to Member, indicating potential privilege elevation.
MikeDuddington, '@dudders1', Huntrule TeamAzureauditlogsMedium439Free2022-06-30Azure AD Sign-ins from Unknown Devices with Single-Factor Authentication
Alerts on successful Azure sign-ins using single-factor authentication with unknown or missing device identifiers from non-trusted contexts.
Michael Epping, '@mepples21', Huntrule TeamAzuresigninlogsLow334Free2022-06-28Azure AD Sign-ins from Non-Compliant Devices
Alert on Entra ID sign-ins originating from devices flagged as non-compliant.
Michael Epping, '@mepples21', Huntrule TeamAzuresigninlogsHigh211Free2022-06-28Azure Sign-In Logs: Device Registration or Join Success Without MFA
Flags successful device registration/join attempts in Azure when MFA was not performed per Conditional Access.
Michael Epping, '@mepples21', Huntrule TeamAzuresigninlogsMedium162Free2022-06-28Azure Audit Logs: User Added to Global or Device Administrator Roles
Alerts when Azure AD role-management events add users to Global or Device Administrator roles.
Michael Epping, '@mepples21', Huntrule TeamAzureauditlogsHigh315Free2022-06-28Azure AD/Entra Audit Logs: Device Registration Policy Changes
Alerts on Azure audit log events that set or modify the device registration policy.
Michael Epping, '@mepples21', Huntrule TeamAzureauditlogsHigh459Free2022-06-28Azure Audit Logs: BitLocker Key Read Activity
Alerts on Azure audit events reading BitLocker keys, which can enable recovery and encryption bypass.
Michael Epping, '@mepples21', Huntrule TeamAzureauditlogsMedium101Free2022-06-28Azure AD Sign-ins Using Legacy Authentication Client Applications
Alerts on Azure sign-ins using legacy protocol client apps (IMAP/POP3/SMTP/EWS/ActiveSync), which may indicate risky authentication usage.
Yochana Henderson, '@Yochana-H', Huntrule TeamAzuresigninlogsHigh152Free2022-06-17