Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
415 rules
GCP Cloud SQL Database Modified or Deleted via Audit API
Alerts on Cloud SQL instance create/delete and user update/delete events in GCP audit logs.
Austin Songer @austinsonger, Huntrule TeamGcpgcp.auditMedium193Free2021-10-15Azure Sign-in Logs: Conditional Access Blocks User Token Issuance (ResultType 53003)
Flags Azure sign-in attempts blocked by Conditional Access due to token issuance denial.
AlertIQ, Huntrule TeamAzuresigninlogsMedium4310Free2021-10-10Azure Sign-in Log MFA Interrupted via Strong Auth Failures
Identifies Azure sign-ins that fail during strong/MFA authentication, suggesting blocked credential attempts.
AlertIQ, Huntrule TeamAzuresigninlogsMedium345Free2021-10-10Azure AD Sign-in Attempts to Disabled Accounts
Alerts on Azure AD sign-in attempts that fail because the target account is disabled.
AlertIQ, Huntrule TeamAzuresigninlogsMedium413Free2021-10-10Azure AD Sign-In Logs: Account Locked After Too Many Failed Password/User ID Attempts
Flags Azure sign-in events where accounts are locked due to excessive failed logons from wrong user ID or password.
AlertIQ, Huntrule TeamAzuresigninlogsMedium358Free2021-10-10Azure Audit Logs: User registered security info (authentication method change)
Flags Azure AD audit events where a user registers new authentication security info.
AlertIQ, Huntrule TeamAzureauditlogsMedium123Free2021-10-10Azure AD Audit Logs: User Added to Administrator Role
Flags Azure AD audit events where a user is added to an Admin/Administrator role.
Raphaël CALVET, @MetallicHack, Huntrule TeamAzureauditlogsMedium133Free2021-10-04AWS Glue Dev Endpoint Lifecycle Events (Create/Update/Delete) via CloudTrail
Flags Glue Create/Update/DeleteDevEndpoint API activity in CloudTrail that may indicate suspicious development endpoint management.
Austin Songer @austinsonger, Huntrule TeamAwscloudtrailLow191Free2021-10-03AWS CloudTrail: Lambda Function Updated with New Layer Attached
Flags CloudTrail UpdateFunctionConfiguration calls that attach Lambda layers to an existing function.
Austin Songer, Huntrule TeamAwscloudtrailLow182Free2021-09-23AWS CloudTrail Alert for Suspicious SAML Role Assumption and SAML Provider Updates
Flags CloudTrail activity involving SAML provider updates plus SAML role assumptions in AWS, which can enable backdoor access.
Austin Songer, Huntrule TeamAwscloudtrailMedium375Free2021-09-22Azure Activity Logs: New CloudShell Created via Microsoft.Portal Consoles Write
Alerts on Azure portal activity indicating a Cloud Shell console was created.
Austin Songer, Huntrule TeamAzureactivitylogsMedium461Free2021-09-21Azure AD Domain Federation Settings Modified via Audit Logs
Alerts when federation settings on an Azure AD domain are modified, indicating potential identity trust tampering.
Austin Songer, Huntrule TeamAzureauditlogsMedium263Free2021-09-06Azure Audit Logs: Service Principal Removed via Remove service principal
Flags Azure audit log events where a service principal is removed from Entra ID.
Austin Songer @austinsonger, Huntrule TeamAzureauditlogsMedium276Free2021-09-03Azure Audit Logs: Owner Removed From Application or Service Principal
Alerts on Azure audit log activity indicating an owner was removed from an application or service principal.
Austin Songer @austinsonger, Huntrule TeamAzureauditlogsMedium173Free2021-09-03Azure Audit Logs: Device No Longer Managed or Compliant
Alerts on Azure device audits indicating the device is no longer managed or compliant.
Austin Songer @austinsonger, Huntrule TeamAzureauditlogsMedium345Free2021-09-03