Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
415 rules
Google Workspace login activity: Out-of-domain email forwarding
Flags Google Workspace out-of-domain email forwarding events from audit logs on login.googleapis.com.
Tom kluter, Huntrule TeamGcpgoogle_workspace.loginMedium112Free2026-04-28Google Workspace login event flagged with gov_attack_warning
Alerts on Google Workspace login audit events marked with gov_attack_warning by Google’s risk signals.
Tom Kluter, Huntrule TeamGcpgoogle_workspace.loginMedium243Free2026-04-28Microsoft 365 inbound suspicious email delivered to Inbox or Junk
Alerts when Defender-labeled suspicious inbound emails are delivered to user Inbox/Junk in Microsoft 365.
Marco Pedrinazzi (@pedrinazziM) (InTheCyber), Huntrule TeamM365auditMedium457Free2026-01-27AWS CloudTrail GuardDuty Detector Deleted or Disabled via UpdateDetector
Identifies successful GuardDuty detector deletion or disablement from CloudTrail, reducing GuardDuty monitoring coverage.
suktech24, Huntrule TeamAwscloudtrailHigh2210Free2025-11-27AWS CloudTrail: TruffleHog User-Agent Execution Detected
Flags AWS CloudTrail events with user agent "TruffleHog" to surface potential secret-scanning or credential-harvesting activity.
Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule TeamAwscloudtrailMedium122Free2025-10-21AWS CloudTrail Detects EC2 DeleteFlowLogs API Calls
Flags successful EC2 DeleteFlowLogs API calls in CloudTrail indicating VPC Flow Logs were removed.
Ivan Saakov, Huntrule TeamAwscloudtrailHigh222Free2025-10-19AWS CloudTrail Account EnableRegion Command Usage
Alerts on AWS account region enablement via CloudTrail when the EnableRegion API call occurs.
Ivan Saakov, Sergey Zelenskiy, Huntrule TeamAwscloudtrailMedium103Free2025-10-19AWS CloudTrail ConsoleLogin Failed authentication
Flags CloudTrail ConsoleLogin events with "Failed authentication" to help identify possible credential-based attacks.
Ivan Saakov, Nasreddine Bencherchali, Huntrule TeamAwscloudtrailMedium261Free2025-10-19AWS CloudTrail S3 DeleteBucket Events with Successful Deletion
Flags successful CloudTrail DeleteBucket events indicating an S3 bucket was removed.
Ivan Saakov, Nasreddine Bencherchali, Huntrule TeamAwscloudtrailMedium314Free2025-10-19AWS KMS Imported Key Material Import or Deletion via CloudTrail
Detects AWS KMS imported key material events in CloudTrail, including import and deletion of imported key material.
toopricey, Huntrule TeamAwscloudtrailHigh183Free2025-10-18AWS CloudTrail Successful ConsoleLogin Events Without MFA
Flags successful AWS console logins with MFAUsed explicitly set to NO in CloudTrail.
Thuya@Hacktilizer, Ivan Saakov, Huntrule TeamAwscloudtrailMedium142Free2025-10-18AWS CloudTrail Detects STS GetCallerIdentity Calls with TruffleHog User-Agent
Identifies TruffleHog-labeled STS GetCallerIdentity calls in AWS CloudTrail, indicating possible AWS key validation or enumeration.
Adan Alvarez @adanalvarez, Huntrule TeamAwscloudtrailMedium401Free2025-10-12M365 Audit: Successful Intune Company Portal login via Cmsi
Flags successful Company Portal (Intune) logins via Cmsi audit events that may indicate Conditional Access bypass attempts.
Josh Nickels, Marius Rothenbücher, Huntrule TeamM365auditHigh532Free2025-01-08AWS CloudTrail: CreateFunctionUrlConfig Indicates Lambda Function URL Added
Flags when a Lambda Function URL configuration is created via the CreateFunctionUrlConfig API call.
Ivan Saakov, Huntrule TeamAwscloudtrailMedium202Free2024-12-19AWS EC2 ImportKeyPair Activity Monitoring (CloudTrail)
Flags CloudTrail EC2 ImportKeyPair events that may indicate newly imported SSH key access setup.
Ivan Saakov, Huntrule TeamAwscloudtrailMedium141Free2024-12-19