Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
415 rules
Azure Activity Logs: Virtual Network Modified or Deleted
Alerts on Azure Activity Log operations that modify (WRITE) or delete (DELETE) Virtual Network resources.
Austin Songer @austinsonger, Huntrule TeamAzureactivitylogsMedium162Free2021-08-08Azure Virtual Network Device Modified or Deleted via Activity Logs
Alerts on Azure Activity Log operations that write or delete virtual network devices such as NICs, virtual appliances, hubs, and routers.
Austin Songer @austinsonger, Huntrule TeamAzureactivitylogsMedium163Free2021-08-08Azure Activity Log: Network Security Group Config Modified or Deleted
Alerts on Azure Activity Log operations indicating NSG or NSG security rule changes (write/delete) that can weaken network security.
Austin Songer @austinsonger, Huntrule TeamAzureactivitylogsMedium182Free2021-08-08Azure Activity Logs: Point-to-site VPN Gateway Modified or Deleted
Flags Azure Point-to-site VPN gateway modifications or deletions from Activity Log operation events.
Austin Songer @austinsonger, Huntrule TeamAzureactivitylogsMedium464Free2021-08-08Azure Firewall Rule Configuration Modified or Deleted via Activity Logs
Flags Azure Activity Log write/delete operations that modify or delete firewall rule groups or rule collection groups.
Austin Songer @austinsonger, Huntrule TeamAzureactivitylogsMedium171Free2021-08-08Azure Firewall Rule Collection Modified or Deleted via Activity Logs
Alerts on Azure Firewall rule collection write or delete operations for Application, NAT, or Network components.
Austin Songer @austinsonger, Huntrule TeamAzureactivitylogsMedium192Free2021-08-08Azure Firewall Created, Modified, or Deleted via Activity Log
Alerts on Azure Firewall write or delete events in Azure Activity Logs, signaling potential defense impairment.
Austin Songer @austinsonger, Huntrule TeamAzureactivitylogsMedium173Free2021-08-08Azure Activity Logs: DNS Zone Write or Delete Operations
Alerts on Azure Activity Log events indicating DNS zone WRITE or DELETE operations.
Austin Songer @austinsonger, Huntrule TeamAzureactivitylogsMedium191Free2021-08-08Azure Kubernetes Service Service Account Modified or Deleted Activity Log Events
Alerts on Azure Activity Log events where a Kubernetes service account is written, deleted, or impersonated.
Austin Songer @austinsonger, Huntrule TeamAzureactivitylogsMedium172Free2021-08-07Azure Kubernetes Activity Logs: Write/Delete of ConfigMaps or Secrets
Alerts on Azure AKS activity log operations that write or delete Kubernetes ConfigMaps or Secrets.
Austin Songer @austinsonger, Huntrule TeamAzureactivitylogsMedium316Free2021-08-07Azure Kubernetes RBAC RoleBinding/ClusterRoleBinding Written or Deleted
Alerts on Azure Kubernetes RBAC RoleBinding/ClusterRoleBinding write or delete events that may indicate permission changes.
Austin Songer @austinsonger, Huntrule TeamAzureactivitylogsMedium456Free2021-08-07Azure Activity Logs: Kubernetes ClusterRole/Role Write, Delete, Bind, or Escalate Changes
Alerts on Azure Kubernetes RBAC Role/ClusterRole writes, deletions, bind, or escalation actions in activity logs.
Austin Songer @austinsonger, Huntrule TeamAzureactivitylogsMedium374Free2021-08-07Azure Activity Logs: Kubernetes Network Policy Write/Delete Changes
Alerts on Azure Activity Log events that modify or remove Kubernetes network policies for connected clusters.
Austin Songer @austinsonger, Huntrule TeamAzureactivitylogsMedium262Free2021-08-07Azure Activity Logs: Azure Kubernetes Connected Cluster Created or Deleted
Alerts on Azure Activity Log operations that write or delete Kubernetes Connected Clusters.
Austin Songer @austinsonger, Huntrule TeamAzureactivitylogsLow193Free2021-08-07Azure Activity Logs: Container Registry Created or Deleted
Flags Azure Activity Log events where an Azure Container Registry is created (write) or deleted.
Austin Songer @austinsonger, Huntrule TeamAzureactivitylogsLow512Free2021-08-07