Sigma detection rules, expert-reviewed

Malicious Business Email Compromise OAuth Application Sign-In via Entra ID Service Principal (via azure)

This rule detects Entra ID sign-ins tied to the PerfectData Software and eM Client OAuth application identifiers that Red Canary observed adversaries abusing to gain persistent mailbox access during business email compromise schemes. Attackers consent these third-party mail applications into a compromised tenant so they can read and exfiltrate mail through issued tokens without the victim password, making any sign-in with these application IDs a strong compromise indicator.

Suspicious AWS GetCallerIdentity From TruffleHog User Agent via Cloudtrail

This rule detects AWS STS GetCallerIdentity calls carrying a TruffleHog user agent, a validation step the Shai-Hulud worm performs against stolen access keys before exfiltration. Attackers confirm harvested cloud credentials are valid prior to abuse, so TruffleHog-attributed API activity in production accounts indicates credential theft and reconnaissance.

Suspicious AWS API Call from TruffleHog Credential Scanner User Agent

This rule detects AWS CloudTrail activity carrying a TruffleHog user agent which indicates that a compromised or unauthorized IAM identity is being used to enumerate and validate secrets against the environment. Adversaries run TruffleHog with stolen credentials to confirm access and discover further secrets. Detecting this user agent surfaces credential reconnaissance in the cloud control plane.

AWS CloudTrail: S3 Block Public Access disabled via PutBucketPublicAccessBlock

Alerts when CloudTrail shows S3 Block Public Access settings being weakened (set to false) in PutBucketPublicAccessBlock with Success.

Malicious Mass Device Wipe via Intune Remote Actions (via m365)

This rule detects Intune remote wipe and factory reset actions in Microsoft 365 audit logs, a destructive technique associated with Handala-linked wiper operations that abuse device management to erase endpoints at scale. Mass remote wipe actions cause widespread data and availability loss, so such events outside authorized decommissioning should be investigated urgently.

Suspicious Exchange Inbox Forwarding Rule Creation via M365 (via m365)

This rule detects creation or modification of Exchange inbox rules that forward or silently delete messages, a hallmark of the Jingle Thief gift card fraud campaign. The actors hide fraud-related correspondence by auto-forwarding and moving sent items to Deleted Items. Detecting this rule change exposes mailbox manipulation used to conceal ongoing business email compromise.

Possible Public Bucket IAM Binding for Data Exfiltration (via gcp)

This rule detects GCP IAM policy changes that grant the allAuthenticatedUsers or allUsers principals object-creator access on storage buckets, exposing them to universal write. Attackers abuse this global-namespace binding to hijack buckets and stage cloud data exfiltration.

Suspicious Cloud Storage Access by Vertex AI P4SA Identity (via gcp)

This rule detects Cloud Storage object and bucket access performed by the Vertex AI service agent identity, a data access behavior shown in the Double Agents research to enable theft of data via a stolen P4SA credential. Storage reads by the AI platform agent outside expected pipelines indicate misuse of the compromised service identity to reach protected data.

Suspicious Artifact Registry Enumeration by Vertex AI Service Agent (via gcp)

This rule detects the Vertex AI per-product service agent enumerating Artifact Registry packages, a cloud discovery behavior demonstrated in the Double Agents research against GCP Vertex AI. Enumeration of container and package registries by the AI platform identity reflects abuse of the P4SA credential to map resources beyond its intended scope.

Suspicious Compute Instance Metadata Modification in GCP

This rule detects modification of GCP compute instance metadata through compute.instances.setMetadata, a technique adversaries use to inject SSH keys or startup scripts and gain execution on virtual machines. Changing instance metadata via the control plane provides persistent access without touching the guest network. Detecting this call exposes credentialed access into compute workloads.

Possible Rogue Device Registration in Entra ID (via azure)

This rule detects Entra ID device registration and join events that adversaries abuse to plant attacker-controlled devices for Primary Refresh Token acquisition. Unit 42 observed this technique with ROADtools during nation-state cloud intrusions to establish durable identity-based access.

Suspicious ROADtools User Agent Against Microsoft Graph (via azure)

This rule detects Entra ID sign-ins and Graph activity carrying the roadtools or generic python-requests user agent, indicating use of the ROADtools and roadtx offensive tooling. Nation-state actors use these tools to register rogue devices, acquire Primary Refresh Tokens, and enumerate directory objects.

Suspicious Azure AD Authentication Method Registration for Account Takeover (via azure)

This rule detects registration or update of a security info authentication method in Azure AD Entra ID, the account-takeover step used by the Payroll Pirates after help-desk social engineering. Attackers add an attacker-controlled email or MFA device as an authentication method on service and employee accounts to seize persistent access and alter direct-deposit details.

Malicious AzureHound Cloud Reconnaissance via User Agent (via azure)

This rule detects sign-ins and Graph API activity carrying the azurehound user-agent string, indicating use of the AzureHound collector to enumerate users, groups, roles, and service principals. Threat actors run AzureHound to map Azure and Entra ID attack paths before privilege escalation. Detecting the tool user-agent exposes cloud discovery activity at its source identity.

Suspicious New MFA Authenticator Registration via Azure AD (via azure)

This rule detects registration of new security information such as a Microsoft Authenticator app on an Azure AD identity, a persistence and MFA-bypass step used in the Jingle Thief campaign. The actors register a rogue authenticator to maintain access to compromised accounts. Detecting this registration surfaces attacker enrollment of unauthorized MFA methods after account takeover.