Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
415 rules
Azure Entra PIM Role Setting Changes in Audit Logs
Alerts on Azure PIM role setting update events recorded in audit logs.
Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H', Huntrule TeamAzureauditlogsHigh203Free2022-08-09Azure PIM Alert Setting Disabled (Audit Log Message Detection)
Flags Azure audit log events where PIM alerts are disabled (message: "Disable PIM Alert").
Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H', Huntrule TeamAzureauditlogsHigh525Free2022-08-09Azure PIM Approval or Denial Recorded in Audit Logs
Flags Azure PIM elevation requests that are approved or denied in audit logs for investigation.
Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H', Huntrule TeamAzureauditlogsHigh194Free2022-08-09Azure Audit Logs: User Added to Privileged Eligibility Role
Alerts on Azure audit log events indicating a user was added as an eligible or permanent member to a privileged role.
Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H', Huntrule TeamAzureauditlogsHigh182Free2022-08-06Azure Audit Logs: Removal of Privileged Role Eligible Members
Flags Azure audit log events indicating bulk removal of eligible members from privileged roles.
Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H', Huntrule TeamAzureauditlogsHigh215Free2022-08-05Azure AD: Detect Removal From Group With Conditional Access Policy Modification Rights
Alerts when a user is removed from a group that can modify Conditional Access policies in Azure Entra.
Mark Morowczynski '@markmorow', Thomas Detzner '@tdetzner', Huntrule TeamAzureauditlogsMedium101Free2022-08-04Azure Entra: Added member to group granting Conditional Access policy modification
Alerts when a user is added to a group that can modify Conditional Access policies in Azure Entra ID.
Mark Morowczynski '@markmorow', Thomas Detzner '@tdetzner', Huntrule TeamAzureauditlogsMedium102Free2022-08-04Azure AD audit logs: Successful user-initiated password reset
Alerts on successful Azure AD password reset events initiated by a user account.
YochanaHenderson, '@Yochana-H', Huntrule TeamAzureauditlogsMedium131Free2022-08-03Azure Audit Logs: Admin-initiated App Role Assignments and Privileged Delegated Permissions
Alerts on Azure audit events where an admin grants app roles to a service principal, enabling privileged application access.
Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow', Huntrule TeamAzureauditlogsHigh110Free2022-07-28Azure Audit Logs: End User Consent for Application (Non-Admin Consent)
Identifies end-user consent grants to applications in Azure AD audit logs.
Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow', Huntrule TeamAzureauditlogsLow175Free2022-07-28Azure audit logs: Delegated highly privileged permissions granted for all users
Alerts on Azure audit log events where delegated permissions are granted to all users.
Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow', Huntrule TeamAzureauditlogsHigh150Free2022-07-28Azure AD Sign-in Success Without MFA (Single-Factor Authentication)
Alerts on successful Azure AD sign-ins where MFA was not required and only single-factor authentication was used.
MikeDuddington, '@dudders1', Huntrule TeamAzuresigninlogsLow130Free2022-07-27Azure App/Service Principal Assigned to Entra ID or Azure RBAC Roles (Audit Logs)
Finds Azure role assignments where an app/service principal is granted, eligible, or scoped membership via audit log messages.
Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow', Huntrule TeamAzureauditlogsMedium274Free2022-07-19Azure Entra conditional access policy updated by non-approved actor
Alerts when an Azure Entra Conditional Access policy update occurs, indicating access control changes by an actor outside the approved set.
Corissa Koopmans, '@corissalea', Huntrule TeamAzureauditlogsMedium111Free2022-07-19Azure Entra Conditional Access Policy Deleted by Non-Approved Actor
Flags Azure audit log events where a conditional access policy is deleted.
Corissa Koopmans, '@corissalea', Huntrule TeamAzureauditlogsMedium369Free2022-07-19