Sigma detection rules, expert-reviewed

Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.

ATT&CK coverage

Initial access
Execution
Persistence
Privilege escalation
Defense evasion
Credential access
Discovery
Lateral movement
Collection
Command and control
Exfiltration
Impact

415 rules

Azure Activity Logs: High Rate of VM Creations or Deployment Writes
Flags Azure activity log events showing VM creation or deployment write operations occurring at an anomalously high volume.
sawwinnnaung, Huntrule TeamAzureactivitylogsMedium183
Free2020-05-07
AWS CloudTrail EC2 CreateInstanceExportTask Failure
Flags failed EC2 VM export task creation events in AWS CloudTrail to surface potential instance data extraction attempts.
Diogo Braz, Huntrule TeamAwscloudtrailLow161
Free2020-04-16
AWS CloudTrail: RestoreDBInstanceFromDBSnapshot Creates Public RDS Instance
Detects RDS restores from snapshots that result in a publicly accessible database instance in AWS CloudTrail.
faloker, Huntrule TeamAwscloudtrailHigh491
Free2020-02-12
AWS CloudTrail RDS ModifyDBInstance Master User Password Change
Flags AWS RDS ModifyDBInstance events that include a master user password change.
faloker, Huntrule TeamAwscloudtrailMedium192
Free2020-02-12
AWS CloudTrail CreateAccessKey by Another IAM User (Backdoor Key Creation)
Identifies AWS access key creation where the requester is different from the access key’s target user.
faloker, Huntrule TeamAwscloudtrailMedium2610
Free2020-02-12
AWS EC2 ModifyInstanceAttribute userData Startup Script Change
Detects CloudTrail EC2 userData startup script changes made via ModifyInstanceAttribute.
faloker, Huntrule TeamAwscloudtrailHigh151
Free2020-02-12
AWS GuardDuty CreateIPSet Trusted IP Set Changes (CloudTrail)
Alerts on CloudTrail GuardDuty CreateIPSet events that add or update trusted IP address sets.
faloker, Huntrule TeamAwscloudtrailHigh132
Free2020-02-11
AWS CloudTrail: Root User Credential Usage (UserIdentity.type=Root)
Alerts on CloudTrail activity performed by AWS account root credentials.
vitaliy0x1, Huntrule TeamAwscloudtrailMedium193
Free2020-01-21
AWS CloudTrail: AWS Config Delivery Channel/Recorder Disabled
Identifies CloudTrail actions that delete AWS Config delivery channels or stop the configuration recorder.
vitaliy0x1, Huntrule TeamAwscloudtrailHigh122
Free2020-01-21
AWS CloudTrail Trail Stop/Update/Delete Activity
Detects CloudTrail stop, update, or delete actions that can impair logging and audit visibility.
vitaliy0x1, Huntrule TeamAwscloudtrailMedium2510
Free2020-01-21