Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
415 rules
Azure Entra ID Riskdetection: Anonymous IP Address sign-in risk events
Detects Azure sign-in risk events labeled as anonymized/anonymous IP addresses.
Gloria Lee, '@gleeiamglo', Huntrule TeamAzureriskdetectionHigh192Free2023-08-22Azure risk detection: anomalousToken risk events
Flags Azure Entra ID risk events indicating anomalous token lifetime or use from unfamiliar locations.
Mark Morowczynski '@markmorow', Huntrule TeamAzureriskdetectionHigh182Free2023-08-07AWS CloudTrail: S3 Browser Creates IAM User or Access Key
Alerts on CloudTrail IAM CreateUser/CreateAccessKey actions initiated by a "S3 Browser" user agent.
daniel.bohannon@permiso.io (@danielhbohannon), Huntrule TeamAwscloudtrailHigh141Free2023-05-17AWS CloudTrail: S3 Browser creates inline IAM policy with default bucket placeholder
Detects S3 Browser–initiated IAM PutUserPolicy requests that include a templated S3 bucket placeholder in the inline policy.
daniel.bohannon@permiso.io (@danielhbohannon), Huntrule TeamAwscloudtrailHigh133Free2023-05-17AWS CloudTrail: S3 Browser creating IAM LoginProfiles after querying GetLoginProfile
Flags CloudTrail IAM GetLoginProfile and CreateLoginProfile activity initiated by an S3 Browser user agent.
daniel.bohannon@permiso.io (@danielhbohannon), Huntrule TeamAwscloudtrailHigh521Free2023-05-17Azure Sign-in Success with Legacy Client User-Agent Indicators (MFA Bypass Suspicion)
Alerts on successful Azure sign-ins using legacy client user-agent markers that may indicate MFA bypass attempts.
Harjot Singh, '@cyb3rjy0t', Huntrule TeamAzuresigninlogsHigh292Free2023-03-20Azure Sign-In: Successful single-factor atRisk logins from non-registered devices
Alerts on at-risk successful Azure sign-ins from devices with missing trust type when MFA isn’t required.
Harjot Singh, '@cyb3rjy0t', Huntrule TeamAzuresigninlogsHigh150Free2023-01-10AWS CloudTrail: Potential S3 Bucket Enumeration via ListBuckets by Non-AssumedRole
Identifies S3 ListBuckets calls in CloudTrail that are not from assumed-role identities, which may indicate bucket discovery activity.
Christopher Peacock @securepeacock, SCYTHE @scythe_io, Huntrule TeamAwscloudtrailLow152Free2023-01-06AWS SES Identity Deleted via CloudTrail DeleteIdentity Event
Flags CloudTrail events showing an SES identity was deleted using the DeleteIdentity API.
Janantha Marasinghe, Huntrule TeamAwscloudtrailMedium336Free2022-12-13Azure sign-in logs: Detect AzureHound discovery tool via default User-Agent
Flags successful Azure sign-ins where the User-Agent contains "azurehound", indicating AzureHound discovery.
Janantha Marasinghe, Huntrule TeamAzuresigninlogsHigh211Free2022-11-27Microsoft 365 Threat Management: PST Export via New-ComplianceSearchAction -Export
Flags M365 SecurityComplianceCenter activity that includes New-ComplianceSearchAction with -Export for PST content.
Nikita Khalimonenkov, Huntrule TeamM365threat_managementMedium213Free2022-11-17Azure Audit Logs: Privileged Account Creation via Admin Role Assignment
Flags successful events where a user is added and added to a role, indicating new admin account creation in Azure.
Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H', Tim Shelton, Huntrule TeamAzureauditlogsMedium151Free2022-08-11Azure AD Account Created and Deleted Shortly After Creation (Audit Logs)
Identifies successful Azure user creation and deletion in quick succession, consistent with short-lived account activity.
Mark Morowczynski '@markmorow', MikeDuddington, '@dudders1', Tim Shelton, Huntrule TeamAzureauditlogsHigh202Free2022-08-11Azure Entra Audit Logs: Temporary Access Pass Method Added to an Account
Flags admin registration of a temporary access pass method in Azure audit logs for user accounts.
Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H', Huntrule TeamAzureauditlogsHigh4010Free2022-08-10Azure Entra: Guest User Invitation Failed When Initiated by Non-Privileged User
Identifies failed guest user invitations in Azure audit logs when the inviter lacks required permissions.
Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H', Huntrule TeamAzureauditlogsMedium133Free2022-08-10