Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
415 rules
Azure Activity Logs: Kubernetes Pod Deletion via Connected Clusters API
Flags Azure Activity Log events indicating Kubernetes pods were deleted for connected clusters.
Austin Songer @austinsonger, Huntrule TeamAzureactivitylogsMedium233Free2021-07-24Azure Kubernetes Events Deleted via Activity Logs
Identifies Azure Activity Log entries where Kubernetes event records are deleted for connected clusters.
Austin Songer @austinsonger, Huntrule TeamAzureactivitylogsMedium5410Free2021-07-24AWS CloudTrail: IAMUser STS GetSessionToken Use
Alerts on CloudTrail STS GetSessionToken calls made by IAM users, indicating potential temporary credential misuse.
Austin Songer @austinsonger, Huntrule TeamAwscloudtrailLow211Free2021-07-24AWS CloudTrail: Suspicious STS AssumeRole sessions from Role-issued principals
Alert on CloudTrail AssumeRole events initiated from an already assumed role session.
Austin Songer @austinsonger, Huntrule TeamAwscloudtrailLow237Free2021-07-24AWS CloudTrail S3 Bucket/Replication Configuration Tampering via Management API Calls
Flags CloudTrail S3 management API actions that modify bucket protections or move/restore objects.
Austin Songer @austinsonger, Huntrule TeamAwscloudtrailLow311Free2021-07-24AWS ElastiCache Cache Security Group Modified or Deleted via CloudTrail
Flags CloudTrail activity indicating an ElastiCache security group was modified or deleted.
Austin Songer @austinsonger, Huntrule TeamAwscloudtrailLow457Free2021-07-24AWS CloudTrail: ElastiCache Cache Security Group Created
Flags CloudTrail events indicating a new ElastiCache cache security group was created.
Austin Songer @austinsonger, Huntrule TeamAwscloudtrailLow222Free2021-07-24AWS Route 53 Domain Transfer to Another Account via TransferDomainToAnotherAwsAccount
Alerts on Route 53 domain transfer requests in CloudTrail when a domain is moved to another AWS account.
Elastic, Austin Songer @austinsonger, Huntrule TeamAwscloudtrailLow221Free2021-07-22AWS Route 53 Domain Transfer Lock Disabled via CloudTrail
Alerts when Route 53 domain transfer protection is removed through DisableDomainTransferLock events in CloudTrail.
Elastic, Austin Songer @austinsonger, Huntrule TeamAwscloudtrailLow4610Free2021-07-22AWS EC2: DisableEbsEncryptionByDefault API call to turn off default EBS encryption
Flags when EC2 default EBS encryption is disabled for the current AWS region via CloudTrail.
Sittikorn S, Huntrule TeamAwscloudtrailMedium355Free2021-06-29AWS CloudTrail: Security Hub findings evasion via finding updates or deletions
Identifies Security Hub finding and insight modifications (update or delete) that may impair detection results.
Sittikorn S, Huntrule TeamAwscloudtrailHigh342Free2021-06-28AWS CloudTrail: EC2 Snapshot Attribute Permission Modified for Cross-Account Access
Alerts on CloudTrail ModifySnapshotAttribute events indicating EC2 snapshot permissions were changed for other-account access.
Darin Smith, Huntrule TeamAwscloudtrailMedium314Free2021-05-17Microsoft 365 Impossible Travel Sign-ins Reported as Successful
Alerts on successful Microsoft 365 “Impossible travel activity” events in SecurityComplianceCenter telemetry.
Austin Songer @austinsonger, Huntrule TeamM365threat_managementMedium284Free2020-07-06Azure Activity Logs: Alert on First-Time Source IP for Subscription-Level Rare Operations
Alerts when specified Azure subscription operations occur from a new, previously unseen source IP.
sawwinnnaung, Huntrule TeamAzureactivitylogsMedium172Free2020-05-07Azure Activity Logs: Granting Role Assignments from New Source IPs
Alerts on Azure role assignment permission grants when they originate from a new source IP in Activity Logs.
sawwinnnaung, Huntrule TeamAzureactivitylogsMedium389Free2020-05-07