Sigma detection rules, expert-reviewed

Suspicious Azure Tenant Root Elevation via elevateAccess

This rule detects the Microsoft.Authorization elevateAccess action that grants a Global Administrator root access over all Azure subscriptions. Microsoft observed Storm-0501 abusing this to seize control of the cloud estate before ransomware impact. Tenant-wide elevation is a rare, high-privilege operation, so this action should be verified against expected administrative change.

Suspicious Microsoft 365 File Download with Scripting User Agent and Spoofed Office Client (via m365)

This rule detects Microsoft 365 audit file access and download events that carry a python-requests or Windows PowerShell user agent while presenting the client application identifier of Microsoft Office, an anomaly seen in the BlackFile vishing extortion operation where operators used stolen tokens to bulk-pull SharePoint and OneDrive content. Legitimate Office clients do not present scripting user agents, so this mismatch signals programmatic data theft under a spoofed application identity.

Suspicious Entra ID Password Spraying via ROPC Grant to Azure CLI App

This rule detects Entra ID authentication attempts using the Resource Owner Password Credential (ROPC) flow against the token endpoint while impersonating the well-known Azure CLI first-party application. Reported by Huntress, adversaries abuse ROPC because it submits username and password directly and can bypass interactive MFA prompts, making it a favored vector for password spraying. Detecting non-interactive ROPC grants tied to the Azure CLI app surfaces credential-guessing campaigns before account takeover.

Suspicious Device Code Authentication via Microsoft Authentication Broker

This rule detects device code authentication requests targeting the Microsoft Authentication Broker application, identified by its client identifier 29d9ed98-a469-4536-ade2-f981bc1d605e, which attackers abuse to obtain a Primary Refresh Token during device code phishing. A stolen PRT provides broad, durable access to the victim tenant. This combination is a high-confidence indicator of an OAuth device code phishing attack.

Malicious Consent to Known Traitorware Mail Clients via Azure AD

This rule detects tenant consent grants to the eM Client and SuperMailer applications abused as traitorware in the Huntress Microsoft 365 compromise. Attackers register these legitimate desktop mail apps as service principals to retain covert access to victim mailboxes, so consent to them in an unmanaged tenant is a strong persistence signal.

Malicious OilRig OAuth Application Sign-In via Azure (via azure)

This rule detects Azure AD sign-ins from the OAuth application client ID 860b23a7-d484-481d-9fea-d3e6e129e249 hardcoded in OilRig's cloud-service-powered downloaders. The group abuses this registered application to obtain tokens for Microsoft Graph and EWS based command-and-control, so any sign-in with this AppId indicates C2 activity.

Suspicious OAuth Device Code Sign-In to Authentication Broker via Tycoon 2FA

This rule detects a successful device code authentication against the Microsoft Authentication Broker application. Tycoon 2FA operators adopted OAuth device code phishing to trick users into authorizing attacker-controlled sessions and mint long-lived tokens for non-interactive Exchange and Graph access. Device code grants to the broker app are rare in normal use and indicate token theft.

Suspicious OfficeHome Sign-In With Axios User Agent via Tycoon 2FA Proxy

This rule detects a successful Entra sign-in to the OfficeHome application originating from an axios HTTP client user agent. This pattern is characteristic of the Tycoon 2FA adversary-in-the-middle platform replaying stolen session tokens through automated proxy infrastructure rather than a real browser. A scripted axios agent authenticating interactively indicates session hijacking following a phishing capture.

Suspicious AWS STS AssumeRoot Privilege Escalation To Member Account Root

This rule detects a CloudTrail STS AssumeRoot API call which grants short lived root credentials for a member account and is a powerful privilege escalation path in AWS organizations. Adversaries with a compromised IAM principal invoke AssumeRoot to obtain root level access over a member account and expand control.

Malicious GCP Service Account Backdoor via serviceAccountTokenCreator Grant

This rule detects a google.iam.admin.v1.SetIAMPolicy admin activity event that grants the roles/iam.serviceAccountTokenCreator role, allowing a principal to mint access tokens for a targeted service account. Adversaries use this binding to backdoor a service account and later impersonate it through GenerateAccessToken, keeping durable privileged access. This matters because the grant converts any controlled identity into a lasting path to the service account privileges.

Malicious Azure Elevate Access to User Access Administrator

This rule detects the Microsoft.Authorization/elevateAccess/action operation, which assigns the calling Global Administrator the User Access Administrator role across all Azure subscriptions in the tenant. Adversaries who compromise a Global Administrator use elevateAccess to break out of Entra ID into the Azure resource plane and take control of every subscription. This is important because it is a high-impact privilege escalation that exposes all cloud resources.

Possible Azure Storage Ransomware via Customer-Managed Key Encryption

This rule detects Azure Activity operations that rewrite storage account encryption to attacker-controlled key material, a hijack path for blob storage ransomware. Writing an encryption scope or setting the account key source to Key Vault lets an actor re-encrypt blobs under a key they hold and then deny the victim access. These control-plane encryption changes on production storage accounts warrant urgent review.

Malicious Assignment of a Privileged Azure AD Role (via auditlogs)

This rule detects an account being added to a privileged Azure AD directory role such as Global Administrator or Privileged Role Administrator, an account-manipulation technique used to escalate and entrench control of a tenant. Privileged role assignment is tracked in the Red Canary Threat Detection Report cloud coverage. Detecting this operation surfaces privilege escalation in the identity plane.

Malicious Mailbox Audit Bypass Association in Exchange Online (via exchange)

This rule detects an account being added to the mailbox audit bypass list, which stops Exchange from logging that account's mailbox actions, a defense-evasion technique used to hide mailbox access and rule creation. Mailbox audit bypass is tracked in the Red Canary Threat Detection Report cloud coverage. Detecting this operation surfaces an attacker suppressing mailbox telemetry.

Malicious OAuth Application Granted Full Mailbox and EWS Permissions (via m365)

This rule detects OAuth application permission grants for high privilege mailbox scopes such as full_access_as_app EWS.AccessAsUser.All and ApplicationImpersonation. Midnight Blizzard granted these permissions to attacker-controlled applications to access mailboxes across the tenant.