Sigma detection rules, expert-reviewed

Suspicious IAM Policy Attachment Granting AdministratorAccess

This rule detects an AttachUserPolicy call that attaches the AWS managed AdministratorAccess policy to an IAM user. After compromising an EC2 instance and stealing IMDS credentials the attacker created a rogue IAM user and granted it full administrator rights for persistence and privilege escalation. Sudden attachment of AdministratorAccess to a user is high-signal for cloud account takeover.

Malicious Active Directory Federated Trust Added (via office365)

This rule detects scenarios where an federated trust is added by an attacker.

Suspicious High-Privilege Microsoft Graph Application Role Grant via Azure Audit (via azure)

This rule detects the assignment of high-privilege Microsoft Graph application roles such as AppRoleAssignment.ReadWrite.All, Directory.ReadWrite.All, or RoleManagement.ReadWrite.Directory to a service principal, an escalation path into Azure highlighted by Red Canary. Granting these permissions lets an app rewrite directory roles and grant itself further access, making it a powerful and stealthy persistence mechanism that should be tightly controlled.

AWS CloudTrail GuardDuty Detector Deleted or Disabled via UpdateDetector

Identifies successful GuardDuty detector deletion or disablement from CloudTrail, reducing GuardDuty monitoring coverage.

AWS CloudTrail Detects EC2 DeleteFlowLogs API Calls

Flags successful EC2 DeleteFlowLogs API calls in CloudTrail indicating VPC Flow Logs were removed.

AWS KMS Imported Key Material Import or Deletion via CloudTrail

Detects AWS KMS imported key material events in CloudTrail, including import and deletion of imported key material.

M365 Audit: Successful Intune Company Portal login via Cmsi

Flags successful Company Portal (Intune) logins via Cmsi audit events that may indicate Conditional Access bypass attempts.

AWS CloudTrail: RDS Cluster Modification or Deletion (ModifyDBCluster/DeleteDBCluster)

Detects CloudTrail ModifyDBCluster or DeleteDBCluster actions on AWS RDS clusters.

Azure AD Audit: Update User Risk and MFA Registration Policy

Flags Azure AD audit events showing updates to user risk and MFA registration policy.

AWS CloudTrail SSM SendCommand Successful Execution for Instance

Identifies successful AWS SSM SendCommand executions recorded in CloudTrail.

AWS CloudTrail: Instance Profile Role Assumed Actions Outside SSM RegisterManagedInstance

Identifies CloudTrail activity from assumed-role instance identities when it is not part of SSM RegisterManagedInstance.

AWS CloudTrail: AWS Identity Center Identity Provider Configuration Changes

Detects CloudTrail identity center events that associate or change the external identity provider configuration.

Microsoft 365 Audit: Disabling Strong Authentication (MFA)

Flags Microsoft 365 audit events indicating MFA/strong authentication was disabled.

Azure Entra PIM Alerts: Too Many Global Administrators Assigned to Tenant

Alerts when Azure PIM reports an overabundance of Global Administrator role assignments in a tenant.

Azure AD PIM Redundant Assignment Alert When Privileged Role Not Used

Alerts on Azure PIM redundant privileged role assignments where the assigned role appears unused.