Sigma detection rules, expert-reviewed

Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.

ATT&CK coverage

Initial access
Execution
Persistence
Privilege escalation
Defense evasion
Credential access
Discovery
Lateral movement
Collection
Command and control
Exfiltration
Impact

313 rules

Microsoft 365 Impossible Travel Sign-ins Reported as Successful
Alerts on successful Microsoft 365 “Impossible travel activity” events in SecurityComplianceCenter telemetry.
Austin Songer @austinsonger, Huntrule TeamM365threat_managementMedium224
Free2020-07-06
Azure Activity Logs: Alert on First-Time Source IP for Subscription-Level Rare Operations
Alerts when specified Azure subscription operations occur from a new, previously unseen source IP.
sawwinnnaung, Huntrule TeamAzureactivitylogsMedium142
Free2020-05-07
Azure Activity Logs: Granting Role Assignments from New Source IPs
Alerts on Azure role assignment permission grants when they originate from a new source IP in Activity Logs.
sawwinnnaung, Huntrule TeamAzureactivitylogsMedium359
Free2020-05-07
Azure Activity Logs: High Rate of VM Creations or Deployment Writes
Flags Azure activity log events showing VM creation or deployment write operations occurring at an anomalously high volume.
sawwinnnaung, Huntrule TeamAzureactivitylogsMedium153
Free2020-05-07
AWS CloudTrail EC2 CreateInstanceExportTask Failure
Flags failed EC2 VM export task creation events in AWS CloudTrail to surface potential instance data extraction attempts.
Diogo Braz, Huntrule TeamAwscloudtrailLow101
Free2020-04-16
AWS CloudTrail: RestoreDBInstanceFromDBSnapshot Creates Public RDS Instance
Detects RDS restores from snapshots that result in a publicly accessible database instance in AWS CloudTrail.
faloker, Huntrule TeamAwscloudtrailHigh461
Free2020-02-12
AWS CloudTrail RDS ModifyDBInstance Master User Password Change
Flags AWS RDS ModifyDBInstance events that include a master user password change.
faloker, Huntrule TeamAwscloudtrailMedium132
Free2020-02-12
AWS CloudTrail CreateAccessKey by Another IAM User (Backdoor Key Creation)
Identifies AWS access key creation where the requester is different from the access key’s target user.
faloker, Huntrule TeamAwscloudtrailMedium2410
Free2020-02-12
AWS EC2 ModifyInstanceAttribute userData Startup Script Change
Detects CloudTrail EC2 userData startup script changes made via ModifyInstanceAttribute.
faloker, Huntrule TeamAwscloudtrailHigh81
Free2020-02-12
AWS GuardDuty CreateIPSet Trusted IP Set Changes (CloudTrail)
Alerts on CloudTrail GuardDuty CreateIPSet events that add or update trusted IP address sets.
faloker, Huntrule TeamAwscloudtrailHigh102
Free2020-02-11
AWS CloudTrail: Root User Credential Usage (UserIdentity.type=Root)
Alerts on CloudTrail activity performed by AWS account root credentials.
vitaliy0x1, Huntrule TeamAwscloudtrailMedium123
Free2020-01-21
AWS CloudTrail: AWS Config Delivery Channel/Recorder Disabled
Identifies CloudTrail actions that delete AWS Config delivery channels or stop the configuration recorder.
vitaliy0x1, Huntrule TeamAwscloudtrailHigh112
Free2020-01-21
AWS CloudTrail Trail Stop/Update/Delete Activity
Detects CloudTrail stop, update, or delete actions that can impair logging and audit visibility.
vitaliy0x1, Huntrule TeamAwscloudtrailMedium2410
Free2020-01-21