Sigma detection rules, expert-reviewed

Suspicious Token Request Using Microsoft Authentication Broker Client to Obtain Primary Refresh Token (via azure)

This rule detects token requests made through the Microsoft Authentication Broker client toward the Device Registration Service, the sequence Storm-2372 uses after harvesting device-code tokens to register an actor-controlled device and obtain a Primary Refresh Token. Adversaries leverage the broker client and a rogue device registration to gain durable access to a victim tenant, making this pairing a high-value detection for post-phishing persistence.

Suspicious Microsoft 365 File Download with Scripting User Agent and Spoofed Office Client (via m365)

This rule detects Microsoft 365 audit file access and download events that carry a python-requests or Windows PowerShell user agent while presenting the client application identifier of Microsoft Office, an anomaly seen in the BlackFile vishing extortion operation where operators used stolen tokens to bulk-pull SharePoint and OneDrive content. Legitimate Office clients do not present scripting user agents, so this mismatch signals programmatic data theft under a spoofed application identity.

Suspicious Exchange Deletion of MFA Notification Emails

This rule detects Exchange SoftDelete and HardDelete operations that ShinyHunters actors use to remove multi factor authentication change notifications from a victim mailbox. Attackers purge these alerts to hide account takeover and MFA tampering from the legitimate user.

Suspicious SharePoint Search Queries for Sensitive Documents

This rule detects SharePoint search queries for sensitive terms such as confidential vpn poc and password as observed in ShinyHunters SaaS data theft reconnaissance. Attackers search compromised tenants to locate high value documents before exfiltration.

Suspicious SharePoint File Download Using PowerShell User Agent

This rule detects SharePoint or OneDrive file download events whose user agent contains PowerShell as observed in ShinyHunters branded SaaS data theft. Attackers script bulk downloads of documents after harvesting SSO credentials through vishing.

Suspicious Help Desk Impersonation via External Microsoft Teams Chat

This rule detects creation of a Microsoft Teams chat that includes users from a foreign tenant where the external participant display name contains help, a social-engineering pattern used by UNC3944 to impersonate IT help desk staff and coerce victims into resetting credentials or MFA. Attackers abuse this trusted-communication channel to gain initial access before escalating to enterprise systems.

Suspicious M365 Sign-In from Synthetic iPhone User Agent via m365

This rule detects Microsoft 365 sign-ins presenting a synthetic iPhone user agent string carrying an implausible Version/26 token. Operators in the Railway PaaS token replay campaign forged iOS user agents when replaying stolen tokens, so this crafted device string is an indicator of non-genuine client access to the tenant.

Suspicious M365 Device Code Authentication Flow via m365

This rule detects Microsoft 365 sign-ins that use the device code authentication flow. The Railway PaaS campaign relied on device code phishing to trick users into authorizing attacker-controlled sessions, so device code grants outside of known kiosk or IoT enrollment scenarios indicate probable phishing-driven token theft.

Suspicious M365 Sign-In from Programmatic Password Spraying User Agent

This rule detects Microsoft 365 sign-in activity presenting user agents associated with programmatic HTTP libraries and password spraying frameworks such as Axios, python-requests, CredMaster, and TREVORspray. These clients drive automated credential attacks against cloud identities from non-interactive infrastructure. Programmatic sign-in agents against user accounts indicate credential stuffing or spraying rather than legitimate browser access.

Suspicious Inbox Rule Hiding Mail to Deleted Items via M365 Exchange

This rule detects inbox rules that match on the @ character and move matching messages to the Deleted Items folder in Microsoft 365. This behavior was used in the Huntress traitorware intrusion to hide reply and alert traffic, a common business email compromise evasion technique that conceals ongoing mailbox abuse from the legitimate user.

Suspicious Entra ID Password Spraying via ROPC Grant to Azure CLI App

This rule detects Entra ID authentication attempts using the Resource Owner Password Credential (ROPC) flow against the token endpoint while impersonating the well-known Azure CLI first-party application. Reported by Huntress, adversaries abuse ROPC because it submits username and password directly and can bypass interactive MFA prompts, making it a favored vector for password spraying. Detecting non-interactive ROPC grants tied to the Azure CLI app surfaces credential-guessing campaigns before account takeover.

Suspicious Entra ROPC Password Spray Against Azure CLI Client

This rule detects Entra ID sign-ins using the Resource Owner Password Credential flow against the Azure CLI application, matching the LSHIY password spray campaign. The ROPC flow submits usernames and passwords directly and cannot satisfy interactive MFA, making it a favored channel for spraying against tenants with conditional access gaps. Repeated ROPC attempts against Azure CLI indicate automated credential guessing.

Possible Illicit Consent Grant to OAuth Application via Azure AD

This rule detects a user or admin consent grant to an OAuth service principal, a technique used in the illicit consent grant attacks documented by Huntress. Adversaries lure victims into consenting to attacker-controlled applications to obtain long-lived access tokens for mail and directory data. Because legitimate app consent is common, this detection is best paired with anomalous application naming or reply URLs and treated as a hunting lead.

Suspicious Device Code Authentication via Microsoft Authentication Broker

This rule detects device code authentication requests targeting the Microsoft Authentication Broker application, identified by its client identifier 29d9ed98-a469-4536-ade2-f981bc1d605e, which attackers abuse to obtain a Primary Refresh Token during device code phishing. A stolen PRT provides broad, durable access to the victim tenant. This combination is a high-confidence indicator of an OAuth device code phishing attack.

Malicious Consent to Known Traitorware Mail Clients via Azure AD

This rule detects tenant consent grants to the eM Client and SuperMailer applications abused as traitorware in the Huntress Microsoft 365 compromise. Attackers register these legitimate desktop mail apps as service principals to retain covert access to victim mailboxes, so consent to them in an unmanaged tenant is a strong persistence signal.