Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
415 rules
Azure Conditional Access Policy Added by Non-approved Actor
Alerts on Azure audit log events indicating a Conditional Access policy was added.
Corissa Koopmans, '@corissalea', Huntrule TeamAzureauditlogsMedium203Free2022-07-18Azure Audit Logs: App Granted Microsoft Graph/Exchange/SharePoint/Azure AD Permissions
Alerts on Azure AD audit log entries where an app/service principal is granted delegated or app-role permissions to Microsoft services.
Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow', Huntrule TeamAzureauditlogsHigh130Free2022-07-10Azure AD End-User Consent Blocked for Risk-Based Risky App Exceptions
Alerts when Azure end-user consent is blocked due to risk-based consent for risky apps.
Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow', Huntrule TeamAzureauditlogsMedium145Free2022-07-10Azure Audit Logs: UserType updated from Guest to Member
Alerts when an Azure user’s UserType is updated from Guest to Member, indicating potential privilege elevation.
MikeDuddington, '@dudders1', Huntrule TeamAzureauditlogsMedium449Free2022-06-30Azure AD Sign-ins from Unknown Devices with Single-Factor Authentication
Alerts on successful Azure sign-ins using single-factor authentication with unknown or missing device identifiers from non-trusted contexts.
Michael Epping, '@mepples21', Huntrule TeamAzuresigninlogsLow354Free2022-06-28Azure AD Sign-ins from Non-Compliant Devices
Alert on Entra ID sign-ins originating from devices flagged as non-compliant.
Michael Epping, '@mepples21', Huntrule TeamAzuresigninlogsHigh251Free2022-06-28Azure Sign-In Logs: Device Registration or Join Success Without MFA
Flags successful device registration/join attempts in Azure when MFA was not performed per Conditional Access.
Michael Epping, '@mepples21', Huntrule TeamAzuresigninlogsMedium282Free2022-06-28Azure Audit Logs: User Added to Global or Device Administrator Roles
Alerts when Azure AD role-management events add users to Global or Device Administrator roles.
Michael Epping, '@mepples21', Huntrule TeamAzureauditlogsHigh325Free2022-06-28Azure AD/Entra Audit Logs: Device Registration Policy Changes
Alerts on Azure audit log events that set or modify the device registration policy.
Michael Epping, '@mepples21', Huntrule TeamAzureauditlogsHigh509Free2022-06-28Azure Audit Logs: BitLocker Key Read Activity
Alerts on Azure audit events reading BitLocker keys, which can enable recovery and encryption bypass.
Michael Epping, '@mepples21', Huntrule TeamAzureauditlogsMedium171Free2022-06-28Azure AD Sign-ins Using Legacy Authentication Client Applications
Alerts on Azure sign-ins using legacy protocol client apps (IMAP/POP3/SMTP/EWS/ActiveSync), which may indicate risky authentication usage.
Yochana Henderson, '@Yochana-H', Huntrule TeamAzuresigninlogsHigh152Free2022-06-17Azure AD Account Disabled or Blocked Login Attempt Failures (Sign-in Logs)
Alerts when Azure sign-in attempts fail because the target account is disabled or blocked.
Yochana Henderson, '@Yochana-H', Huntrule TeamAzuresigninlogsMedium435Free2022-06-17AWS ECS Task Definition Commands Query AWS Container Credentials Endpoint
Alerts on ECS Describe/Register/Run activity when task container commands reference the container credential endpoint URI.
Darin Smith, Huntrule TeamAwscloudtrailMedium192Free2022-06-07Azure Audit Logs: Application URI Configuration Changes (AppAddress)
Alerts on Azure audit log events indicating an application URI (AppAddress) was modified.
Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik', Huntrule TeamAzureauditlogsHigh181Free2022-06-02Azure AD: Application Owner Added via Audit Log Message
Detects when an application owner is added in Azure audit logs, granting additional permissions to modify app configuration.
Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik', Huntrule TeamAzureauditlogsMedium228Free2022-06-02