Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
415 rules
Azure Audit Logs: Application AppID URI Updates via App or Service Principal Changes
Alerts on Azure audit log entries indicating updates to an application or service principal AppID URI configuration.
Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik', Huntrule TeamAzureauditlogsHigh101Free2022-06-02Azure Sign-in Logs: Conditional Access Blocked Sign-in Failures (ResultType 53003)
Alerts on Azure sign-ins blocked by Conditional Access when requirements are not met.
Yochana Henderson, '@Yochana-H', Huntrule TeamAzuresigninlogsHigh140Free2022-06-01Azure AD Sign-in Logs: Detect ROPC Authentication Flow Use in Application Sign-ins
Flags Azure AD sign-ins where the message indicates an application is using the ROPC authentication flow.
Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik', Huntrule TeamAzuresigninlogsMedium212Free2022-06-01Azure Sign-in Logs: OAuth Device Code Flow Usage Detected
Alerts on Azure sign-in events showing "Device Code" usage by applications outside expected input-constrained device contexts.
Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik', Huntrule TeamAzuresigninlogsMedium326Free2022-06-01Azure Sign-in Logs: MFA Denied Based on Authentication Requirement
Flags Azure sign-ins requiring MFA where the status indicates "MFA Denied."
AlertIQ, Huntrule TeamAzuresigninlogsMedium283Free2022-03-24Microsoft 365 eDiscovery PST Export or Search Started Success Alert
Alerts on successful eDiscovery search/export activity that produces PST files in Microsoft 365.
Sorina Ionescu, Huntrule TeamM365threat_managementMedium406Free2022-02-08M365 Exchange Add-FederatedDomain Success: New Federated Domain Created
Alerts on successful Exchange addition of a new federated domain via Add-FederatedDomain.
Splunk Threat Research Team (original rule), '@ionsor (rule)', Huntrule TeamM365exchangeMedium162Free2022-02-08Azure Audit Logs: Successful Disable Strong Authentication Indicates MFA Disabled
Alerts on successful MFA disable actions in Azure audit logs that could weaken account authentication.
"@ionsor, Huntrule Team"AzureauditlogsMedium193Free2022-02-08Azure Sign-in Auth Interruption: DeviceAuthenticationRequired/Failed and External Security Challenge
Alerts on Azure sign-in authentication interruptions tied to device authentication and external security challenge failures.
Austin Songer @austinsonger, Huntrule TeamAzuresigninlogsMedium172Free2021-11-26Azure Audit Logs: User Elevated to User Access Administrator Across Azure Subscriptions
Flags Azure AuditLogs events where a user is assigned to User Access Administrator, enabling full subscription management.
Austin Songer @austinsonger, Huntrule TeamAzureauditlogsHigh263Free2021-11-26Azure Activity Logs: Authorization ElevateAccess Grants Subscription-Level Management
Alerts on Azure Activity Log authorization elevation actions that can grant access to manage all subscriptions.
Austin Songer @austinsonger, Huntrule TeamAzureactivitylogsHigh292Free2021-11-26GCP Kubernetes audit events: Admission webhook configuration creates/updates
Flags GCP Kubernetes audit events indicating mutating/validating admission webhook configuration create/patch/replace activity.
Austin Songer @austinsonger, Huntrule TeamGcpgcp.auditMedium181Free2021-11-25Azure Activity Logs: Kubernetes AdmissionRegistration webhook configuration writes
Flags Azure activity log events writing Kubernetes admission webhook configurations (mutating or validating), indicating potential cluster request interception.
Austin Songer @austinsonger, Huntrule TeamAzureactivitylogsMedium192Free2021-11-25GCP Kubernetes CronJob or Job Creation via gcp.audit
Flags GCP audit events where Kubernetes batch Job/CronJob API methods indicate CronJob or Job execution setup.
Austin Songer @austinsonger, Huntrule TeamGcpgcp.auditMedium221Free2021-11-22Azure Activity Logs: Kubernetes CronJob or Job Write Operations
Detects Azure Activity Log write operations for Kubernetes CronJobs and Jobs that can schedule container workloads.
Austin Songer @austinsonger, Huntrule TeamAzureactivitylogsMedium192Free2021-11-22