Sigma detection rules, expert-reviewed

Suspicious VM Run Command Execution in Azure

This rule detects invocation of Azure Virtual Machine run commands that execute operator supplied scripts on a VM through the management plane. Adversaries with valid Azure credentials abuse runCommands to gain code execution on workloads without network-level access as covered in Unit 42 cloud VM attack path research. Detecting these operations exposes control-plane driven execution on virtual machines.

Suspicious CloudTrail Logging Tampering for Defense Evasion (via aws)

This rule detects AWS CloudTrail API calls that stop, delete, or reconfigure trails, including KMS key swaps and redirection to attacker-controlled S3 buckets. Adversaries perform these actions to blind logging and evade detection during cloud intrusions.

Suspicious Cross-Agent Memory Retrieval via Bedrock AgentCore (via aws)

This rule detects Bedrock AgentCore memory retrieval operations that, under the Agent God Mode exploitation of overly permissive IAM, allow one agent to read another agent's stored memory. Cross-agent memory access can expose sensitive conversation and data context, so these calls on shared or wildcard-scoped resources indicate potential data theft.

Suspicious SES Email Identity and Receipt Rule Abuse (via cloudtrail)

This rule detects creation of SES email identities and receipt rules, which JavaGhost abuses to weaponize a victim AWS account for outbound phishing and inbound mail capture. Standing up sending identities and receipt rules turns the compromised account into attacker-controlled email infrastructure.

Malicious IAM Group Creation for SES Abuse by JavaGhost (via cloudtrail)

This rule detects creation of the IAM group AWSSESSendingGroupDoNotRename, a persistence artifact JavaGhost creates to grant SES email-sending permissions for phishing. The deceptively official group name is used to authorize continued abuse of Simple Email Service from the victim account.

Malicious JavaGhost Security Group Creation (via cloudtrail)

This rule detects creation of EC2 security groups named Java_Ghost or bearing the description We Are There But Not Visible, calling cards left by the JavaGhost actor in compromised AWS environments. These empty security groups act as a signature the group plants during its cloud phishing operations.

Malicious S3 Bucket Deletion During Bling Libra Extortion

This rule detects deletion of S3 buckets through the DeleteBucket API, a destructive action the Bling Libra group behind ShinyHunters took after stealing data to pressure victims during extortion. Removing buckets destroys data availability and leaves a ransom note in a newly created bucket. Detecting this exposes destructive impact on cloud storage during an extortion event.

Suspicious S3 Access from Desktop File Transfer Clients by Bling Libra

This rule detects AWS S3 API activity originating from desktop file transfer clients identified by S3 Browser and WinSCP user agents, tooling the Bling Libra group behind ShinyHunters used to enumerate and manipulate buckets with stolen credentials. Interactive client access to S3 is unusual for automated workloads and signals hands-on abuse. Detecting this exposes credentialed data access ahead of extortion.

Suspicious Lambda Function Creation Across Regions in AWS Extortion Operation

This rule detects creation of Lambda functions by an execution role provisioned for the large-scale cloud extortion operation, where the actor deployed functions across many regions to scan targets for exposed environment files and harvest secrets. Programmatic function creation spread across regions reflects automated abuse rather than normal deployment. Detecting these events exposes the actor building out exfiltration tooling.

Malicious Administrator Policy Attachment for Privilege Escalation in AWS

This rule detects the AdministratorAccess managed policy being attached to a role or user through AttachRolePolicy or AttachUserPolicy, a privilege escalation step in the large-scale cloud extortion operation that leveraged leaked environment variables. Granting full admin to a controlled identity gives the actor complete account control. Detecting this exposes escalation ahead of data theft and extortion.

Suspicious SSH Key Push to EC2 via EC2 Instance Connect

This rule detects use of EC2 Instance Connect SendSSHPublicKey and SendSerialConsoleSSHPublicKey to inject a temporary public key onto an instance, an access path abused by adversaries holding valid AWS credentials to reach virtual machines. Pushing keys through the control plane grants interactive access while bypassing key management controls. Detecting these calls exposes credentialed lateral movement into compute workloads.

Suspicious Remote Command Execution to EC2 Instances via AWS SSM

This rule detects use of AWS Systems Manager to run commands or open interactive sessions on EC2 instances through SendCommand and StartSession events. Adversaries with valid cloud credentials abuse SSM to reach virtual machines without SSH or RDP as described in Unit 42 cloud VM attack path research. Detecting these calls exposes control-plane driven access to compute workloads.

Suspicious AWS Secrets Manager Secret Value Retrieval (via cloudtrail)

This rule detects retrieval of stored secret values from AWS Secrets Manager, a credential access action Muddled Libra performs to harvest embedded keys and passwords for deeper compromise. Because applications legitimately call this API, the event is best correlated with unusual principals or volumes rather than treated as malicious on its own.

Suspicious AWS Transfer Family Server Creation for Data Exfiltration (via cloudtrail)

This rule detects creation of AWS Transfer Family servers or users, a capability Muddled Libra provisions to move stolen data out of a compromised account over managed file transfer. Standing up transfer infrastructure is uncommon and, when it follows credential access, indicates an adversary staging exfiltration to an external or attacker controlled destination.

Suspicious SSM Session or Command Execution on EC2 Instance (via cloudtrail)

This rule detects Systems Manager StartSession or SendCommand activity that runs commands or opens interactive sessions on EC2 instances, a technique used to move laterally into workloads using cloud credentials. While SSM is used for legitimate operations, unexpected sessions or command runs from unfamiliar principals indicate an adversary executing code inside instances.