Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
313 rules
GCP Kubernetes RBAC RoleBinding Create/Patch/Update/Delete Audit Events
Flags GCP audit events where Kubernetes RBAC RoleBindings/ClusterRoleBindings are created, modified, or removed.
Austin Songer @austinsonger, Huntrule TeamGcpgcp.auditMedium111Free2021-08-09AWS CloudTrail UpdateLoginProfile: Password/Authentication Profile Modified for Another User
Flags AWS IAM UpdateLoginProfile events where an account updates another user’s login profile password.
toffeebr33k, Huntrule TeamAwscloudtrailHigh3410Free2021-08-09Azure Activity Logs: VPN Connection Modified or Deleted
Alerts on Azure VPN connection updates or removals recorded in Activity Logs.
Austin Songer @austinsonger, Huntrule TeamAzureactivitylogsMedium168Free2021-08-08Azure Activity Logs: Virtual Network Modified or Deleted
Alerts on Azure Activity Log operations that modify (WRITE) or delete (DELETE) Virtual Network resources.
Austin Songer @austinsonger, Huntrule TeamAzureactivitylogsMedium92Free2021-08-08Azure Virtual Network Device Modified or Deleted via Activity Logs
Alerts on Azure Activity Log operations that write or delete virtual network devices such as NICs, virtual appliances, hubs, and routers.
Austin Songer @austinsonger, Huntrule TeamAzureactivitylogsMedium93Free2021-08-08Azure Activity Log: Network Security Group Config Modified or Deleted
Alerts on Azure Activity Log operations indicating NSG or NSG security rule changes (write/delete) that can weaken network security.
Austin Songer @austinsonger, Huntrule TeamAzureactivitylogsMedium142Free2021-08-08Azure Activity Logs: Point-to-site VPN Gateway Modified or Deleted
Flags Azure Point-to-site VPN gateway modifications or deletions from Activity Log operation events.
Austin Songer @austinsonger, Huntrule TeamAzureactivitylogsMedium414Free2021-08-08Azure Firewall Rule Configuration Modified or Deleted via Activity Logs
Flags Azure Activity Log write/delete operations that modify or delete firewall rule groups or rule collection groups.
Austin Songer @austinsonger, Huntrule TeamAzureactivitylogsMedium121Free2021-08-08Azure Firewall Rule Collection Modified or Deleted via Activity Logs
Alerts on Azure Firewall rule collection write or delete operations for Application, NAT, or Network components.
Austin Songer @austinsonger, Huntrule TeamAzureactivitylogsMedium82Free2021-08-08Azure Firewall Created, Modified, or Deleted via Activity Log
Alerts on Azure Firewall write or delete events in Azure Activity Logs, signaling potential defense impairment.
Austin Songer @austinsonger, Huntrule TeamAzureactivitylogsMedium113Free2021-08-08Azure Activity Logs: DNS Zone Write or Delete Operations
Alerts on Azure Activity Log events indicating DNS zone WRITE or DELETE operations.
Austin Songer @austinsonger, Huntrule TeamAzureactivitylogsMedium141Free2021-08-08Azure Kubernetes Service Service Account Modified or Deleted Activity Log Events
Alerts on Azure Activity Log events where a Kubernetes service account is written, deleted, or impersonated.
Austin Songer @austinsonger, Huntrule TeamAzureactivitylogsMedium122Free2021-08-07Azure Kubernetes Activity Logs: Write/Delete of ConfigMaps or Secrets
Alerts on Azure AKS activity log operations that write or delete Kubernetes ConfigMaps or Secrets.
Austin Songer @austinsonger, Huntrule TeamAzureactivitylogsMedium286Free2021-08-07Azure Kubernetes RBAC RoleBinding/ClusterRoleBinding Written or Deleted
Alerts on Azure Kubernetes RBAC RoleBinding/ClusterRoleBinding write or delete events that may indicate permission changes.
Austin Songer @austinsonger, Huntrule TeamAzureactivitylogsMedium356Free2021-08-07Azure Activity Logs: Kubernetes ClusterRole/Role Write, Delete, Bind, or Escalate Changes
Alerts on Azure Kubernetes RBAC Role/ClusterRole writes, deletions, bind, or escalation actions in activity logs.
Austin Songer @austinsonger, Huntrule TeamAzureactivitylogsMedium254Free2021-08-07