Sigma detection rules, expert-reviewed

Microsoft 365 SecurityComplianceCenter: Exfiltration Activity to Unsanctioned Apps

Alerts on successful Cloud App Security reports of data exfiltration attempts using unsanctioned apps.

Microsoft Cloud App Security: Alerts for Successful Activity from Infrequent Countries

Alerts on successful Microsoft Cloud App Security anomaly events for activity from countries not recently visited by your users.

M365 Threat Management: Activity from Anonymous Proxy IP Addresses

Alerts when Microsoft 365 threat management reports successful activity from IPs marked as anonymous proxies.

Microsoft Cloud App Security Activity by Terminated Azure AD User

Alerts on successful "Activity performed by terminated user" events where a terminated Azure AD account still shows activity.

Microsoft Cloud App Security: Activity from Microsoft Threat Intelligence Risky IPs

Alert on successful Cloud App Security activity events tied to IPs marked risky by Microsoft Threat Intelligence.

Google Workspace Admin API: User Granted Admin Privileges

Flags Google Workspace audit events where a user is granted delegated or admin privileges in the tenant.

Google Workspace Admin API Client Authorization Granted to Service Accounts

Identifies Google Workspace domain-level authorization of an API client via admin.googleapis.com audit events.

Microsoft 365 Cloud App Security Alerts on Suspicious Inbox Forwarding Rules

Flags successful Microsoft Cloud App Security alerts for suspicious inbox forwarding behavior.

Microsoft 365 SecurityComplianceCenter: User Restricted From Sending Email

Alerts when Microsoft 365 SecurityComplianceCenter reports a user was successfully restricted from sending email due to sending-limit policy violations.

Microsoft 365 Cloud App Security: Unusual Large Volume of File Deletion

Alerts when Microsoft 365 threat telemetry shows a user successfully deleting an unusually large number of files.

Microsoft 365 Cloud App Security - Potential Ransomware Activity Alerts on File Upload

Flags successful Microsoft Cloud App Security reports of potential ransomware-related file uploads in Microsoft 365.

Google Cloud VPN Tunnel Insert or Delete via Audit Logs

Alerts on Google Cloud audit events showing VPN tunnel insertion or deletion.

Azure Activity Logs: Alert Suppression Rule Write Operations

Flags when an Azure alert suppression rule is created via the security alerts suppression write operation.

Azure Key Vault secret modified or deleted activity

Flags Azure Key Vault secret write, update, delete, purge, and restore operations in Activity Logs.

Azure Key Vault Modified or Deleted via Activity Log Operations

Alerts on Azure Activity Log Key Vault management operations: write, delete, deploy actions, or access policy changes.