Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
415 rules
Microsoft Cloud App Security Activity by Terminated Azure AD User
Alerts on successful "Activity performed by terminated user" events where a terminated Azure AD account still shows activity.
Austin Songer @austinsonger, Huntrule TeamM365threat_managementMedium121Free2021-08-23Microsoft Cloud App Security: Activity from Microsoft Threat Intelligence Risky IPs
Alert on successful Cloud App Security activity events tied to IPs marked risky by Microsoft Threat Intelligence.
Austin Songer @austinsonger, Huntrule TeamM365threat_detectionMedium3510Free2021-08-23Google Workspace Admin API: User Granted Admin Privileges
Flags Google Workspace audit events where a user is granted delegated or admin privileges in the tenant.
Austin Songer, Huntrule TeamGcpgoogle_workspace.adminMedium203Free2021-08-23Google Workspace Admin API Client Authorization Granted to Service Accounts
Identifies Google Workspace domain-level authorization of an API client via admin.googleapis.com audit events.
Austin Songer, Huntrule TeamGcpgoogle_workspace.adminMedium182Free2021-08-23Microsoft 365 Cloud App Security Alerts on Suspicious Inbox Forwarding Rules
Flags successful Microsoft Cloud App Security alerts for suspicious inbox forwarding behavior.
Austin Songer @austinsonger, Huntrule TeamM365threat_managementLow363Free2021-08-22Microsoft 365 SecurityComplianceCenter: User Restricted From Sending Email
Alerts when Microsoft 365 SecurityComplianceCenter reports a user was successfully restricted from sending email due to sending-limit policy violations.
austinsonger, Huntrule TeamM365threat_managementMedium5610Free2021-08-19Microsoft 365 Cloud App Security: Unusual Large Volume of File Deletion
Alerts when Microsoft 365 threat telemetry shows a user successfully deleting an unusually large number of files.
austinsonger, Huntrule TeamM365threat_managementMedium281Free2021-08-19Microsoft 365 Cloud App Security - Potential Ransomware Activity Alerts on File Upload
Flags successful Microsoft Cloud App Security reports of potential ransomware-related file uploads in Microsoft 365.
austinsonger, Huntrule TeamM365threat_managementMedium492Free2021-08-19Google Cloud VPN Tunnel Insert or Delete via Audit Logs
Alerts on Google Cloud audit events showing VPN tunnel insertion or deletion.
Austin Songer @austinsonger, Huntrule TeamGcpgcp.auditMedium171Free2021-08-16Azure Activity Logs: Alert Suppression Rule Write Operations
Flags when an Azure alert suppression rule is created via the security alerts suppression write operation.
Austin Songer, Huntrule TeamAzureactivitylogsMedium457Free2021-08-16Azure Key Vault secret modified or deleted activity
Flags Azure Key Vault secret write, update, delete, purge, and restore operations in Activity Logs.
Austin Songer @austinsonger, Huntrule TeamAzureactivitylogsMedium496Free2021-08-16Azure Key Vault Modified or Deleted via Activity Log Operations
Alerts on Azure Activity Log Key Vault management operations: write, delete, deploy actions, or access policy changes.
Austin Songer @austinsonger, Huntrule TeamAzureactivitylogsMedium162Free2021-08-16Azure Key Vault Key Modified or Deleted via Activity Log Operations
Alerts on Azure Key Vault key create/update/import/recover/restore/backup/purge/delete activity from Activity Logs.
Austin Songer @austinsonger, Huntrule TeamAzureactivitylogsMedium153Free2021-08-16Azure Application Security Group Modified or Deleted via Activity Log Write/Delete
Flags Azure Activity Log events showing Application Security Group write (modify) or delete operations.
Austin Songer, Huntrule TeamAzureactivitylogsMedium203Free2021-08-16Azure Application Gateway Modified or Deleted via Activity Logs
Alerts on Azure Activity Log operations that modify or delete Application Gateway resources.
Austin Songer, Huntrule TeamAzureactivitylogsMedium332Free2021-08-16