Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
415 rules
AWS IAM SAML Provider Deletion via CloudTrail
Alerts on successful CloudTrail events where an AWS SAML provider is deleted, signaling potential disruption of admin/security access.
Ivan Saakov, Huntrule TeamAwscloudtrailMedium2310Free2024-12-19AWS CloudTrail: RDS Cluster Modification or Deletion (ModifyDBCluster/DeleteDBCluster)
Detects CloudTrail ModifyDBCluster or DeleteDBCluster actions on AWS RDS clusters.
Ivan Saakov, Huntrule TeamAwscloudtrailHigh252Free2024-12-06Azure AD: StrongAuthenticationRequirement Set to Disabled/State=0
Alerts on Azure Entra user updates that change StrongAuthenticationRequirement to a disabled State ("State":0).
Harjot Singh (@cyb3rjy0t), Huntrule TeamAzureauditlogsMedium249Free2024-08-21Azure AD Audit: Update User Risk and MFA Registration Policy
Flags Azure AD audit events showing updates to user risk and MFA registration policy.
Harjot Singh (@cyb3rjy0t), Huntrule TeamAzureauditlogsHigh202Free2024-08-13AWS CloudTrail SSM SendCommand Successful Execution for Instance
Identifies successful AWS SSM SendCommand executions recorded in CloudTrail.
jamesc-grafana, Huntrule TeamAwscloudtrailHigh277Free2024-07-11AWS RDS Security Group Changes via CloudTrail
Flags CloudTrail RDS events that create, delete, or change DB security group ingress rules.
jamesc-grafana, Huntrule TeamAwscloudtrailMedium223Free2024-07-11AWS CloudTrail ELB/ALB Security Group Changes via ApplySecurityGroupsToLoadBalancer or SetSecurityGroups
Alerts on CloudTrail events that change ELB/ALB security groups by applying or setting load balancer security groups.
jamesc-grafana, Huntrule TeamAwscloudtrailMedium251Free2024-07-11AWS CloudTrail Security Group Ingress/Egress Rule Changes
Alerts on AWS security group ingress/egress rule authorizations or revocations seen in CloudTrail EC2 events.
jamesc-grafana, Huntrule TeamAwscloudtrailMedium429Free2024-07-11AWS CloudTrail: CreateRoute Adds New Network Route to a Route Table
Flags CloudTrail EC2 CreateRoute events indicating a new route was added to an AWS route table.
jamesc-grafana, Huntrule TeamAwscloudtrailMedium373Free2024-07-11AWS CloudTrail: CreateNetworkAclEntry Adds Network ACL Rules
Identifies when EC2 network ACL entries are created in AWS via CloudTrail.
jamesc-grafana, Huntrule TeamAwscloudtrailLow292Free2024-07-11AWS CloudTrail: Instance Profile Role Assumed Actions Outside SSM RegisterManagedInstance
Identifies CloudTrail activity from assumed-role instance identities when it is not part of SSM RegisterManagedInstance.
jamesc-grafana, Huntrule TeamAwscloudtrailHigh243Free2024-07-11Azure AD Audit: Trusted Root CA Added for Passwordless Certificate Authentication
Alerts on Azure AD changes that add a new trusted root CA for passwordless certificate-based authentication.
Harjot Shah Singh, '@cyb3rjy0t', Huntrule TeamAzureauditlogsMedium251Free2024-03-26Azure AD Audit Logs: Certificate-based authentication enabled via AuthenticationMethodsPolicy update
Flags Azure AD audit log events where the Authentication Methods policy is updated to enable certificate-based authentication.
Harjot Shah Singh, '@cyb3rjy0t', Huntrule TeamAzureauditlogsMedium346Free2024-03-26AWS CloudTrail GetSigninToken Requests with Suspected Console User-Agent
Flags CloudTrail GetSigninToken sign-in token requests with non-matching console user-agent patterns.
Chester Le Bron (@123Le_Bron), Huntrule TeamAwscloudtrailMedium5010Free2024-02-26GCP Google Workspace: Application ContextAwareAccess Setting Changed
Alerts on Google Workspace application setting changes affecting ContextAwareAccess access levels.
Bryan Lim, Huntrule TeamGcpgoogle_workspace.adminMedium162Free2024-01-12