Sigma detection rules, expert-reviewed

Suspicious EC2 Instance Connect SSH Public Key Push (via cloudtrail)

This rule detects the EC2 Instance Connect SendSSHPublicKey call that injects a temporary SSH key into a running instance, a lateral movement technique adversaries use to gain interactive shell access to cloud hosts. Because this API grants direct host access from control plane credentials, unexpected use is a meaningful indicator of an attacker pivoting into compute workloads.

Suspicious EC2 Key Pair Import via aws (via cloudtrail)

This rule detects the AWS ImportKeyPair API call used to upload an attacker-controlled public key so newly launched instances can be accessed. During the SugarCRM cloud intrusion the actor combined ImportKeyPair with RunInstances to establish attacker-usable compute, making an unexpected key import an early sign of cloud resource abuse and persistence.

Malicious Cloud Attack Tooling User Agent in CloudTrail via aws (via cloudtrail)

This rule detects AWS CloudTrail activity originating from the Pacu and ScoutSuite offensive cloud toolkits identified by their user agent strings. These frameworks were used to enumerate and abuse AWS control-plane access after ~/.aws/credentials theft during the SugarCRM zero-day cloud intrusion, indicating an attacker performing hands-on-keyboard cloud reconnaissance and resource abuse.

Malicious Inbox Rule Hiding Security Mail to RSS Feeds via M365 (via m365)

This rule detects creation of an Exchange Online inbox rule that moves messages into the RSS Feeds folder and marks them as read. This is a common business email compromise technique to hide security notifications and replies from the compromised user. Concealing warning mail lets the attacker operate the mailbox and pursue fraud undetected.

Suspicious Azure Contributor Role Assignment to Identity

This rule detects an Azure role assignment granting the built-in Contributor role, the privilege-escalation step used in the Azure Fabric backdoor where a service principal or managed identity was granted Contributor at resource-group scope from a Fabric notebook to drive the control plane. Contributor grants to non-human identities warrant review as a persistence and escalation vector.

Suspicious M365 Sign-In With axios Automation User-Agent (via azure)

This rule detects Azure AD sign-in activity presenting an axios HTTP client user-agent, observed during adversary-in-the-middle session token phishing against M365. Legitimate interactive users do not sign in with the axios library user-agent. Automated access with stolen session tokens indicates account takeover and mailbox abuse.

Suspicious Code of Conduct Phishing Email From cocinternal.com Sender (via m365)

This rule detects inbound email from the cocinternal.com sender infrastructure used in the multi-stage code of conduct phishing campaign that lures recipients into an adversary-in-the-middle page capturing Microsoft sign-in tokens. Adversaries theme these messages around a corporate code of conduct to prompt urgent sign-in, so mail originating from this sender domain warrants review as the entry point to token compromise.

Malicious Exchange Inbox Rule Hiding Direct Deposit and Bank Emails via Payroll Pirate Compromise (via m365)

This rule detects Exchange Online inbox rules that move or delete messages mentioning direct deposit, bank, or payroll, an email-hiding technique used by Storm-2755 to conceal payroll change alerts from compromised Canadian employees. Adversaries suppress these notifications so their rerouting of salary payments goes unnoticed, making inbox rules keyed on payment keywords a high-confidence sign of payroll fraud.

Suspicious Bulk Mail and File Collection via MSGraph Application Access (via m365)

This rule detects application-context access to mailbox items through the Microsoft Graph API by a non-owner identity, the exfiltration behavior Silk Typhoon uses after adding credentials to compromised service principals to steal email and files from targeted tenants. Adversaries prefer app-based MSGraph access to harvest data at scale while evading per-user controls, so bulk MailItemsAccessed events under an application identity indicate cloud data theft.

Suspicious Anonymous Sharing Link Creation in SharePoint or OneDrive via M365 Audit

This rule detects creation of anonymous or secure sharing links in SharePoint and OneDrive, an abuse pattern in which attackers host phishing lures on trusted file services and share them broadly to steal identities. Adversary-in-the-middle campaigns use restricted-access links to evade automated scanning while harvesting session cookies from victims.

Suspicious ApplicationImpersonation Role Assigned to Mailbox Principal (via m365)

This rule detects assignment of the Exchange ApplicationImpersonation management role. Midnight Blizzard used impersonation rights combined with malicious OAuth applications to read targeted mailboxes via Exchange Web Services.

Suspicious OAuth Application Consent Granted High Privilege Mail Scopes (via m365)

This rule detects OAuth application consent operations granting mailbox read write and send permissions. Financially motivated actors registered and consented malicious OAuth applications with mail.readwrite and mail.send scopes to automate mail-based fraud and exfiltration.

Suspicious Legacy Authentication via BAV2ROPC User Agent (via m365)

This rule detects Entra ID sign-ins using the BAV2ROPC user agent that indicates legacy resource owner password credential authentication over IMAP or SMTP. Threat actors abusing OAuth applications used this legacy flow to bypass modern authentication controls for mailbox access.

Suspicious Entra Sign-In With Axios Automation User-Agent via AiTM Token Replay (via azure)

This rule detects Microsoft Entra sign-ins presenting the axios/1.7.9 automation user-agent, a distinctive marker of Storm-2755 replaying stolen tokens through an adversary-in-the-middle framework in payroll pirate attacks against Canadian employees. Because interactive user sign-ins do not originate from the axios HTTP library, this user-agent on authentication traffic strongly indicates automated token replay rather than a legitimate user.

Suspicious Azure Tenant Root Elevation via elevateAccess

This rule detects the Microsoft.Authorization elevateAccess action that grants a Global Administrator root access over all Azure subscriptions. Microsoft observed Storm-0501 abusing this to seize control of the cloud estate before ransomware impact. Tenant-wide elevation is a rare, high-privilege operation, so this action should be verified against expected administrative change.