Sigma detection rules, expert-reviewed

Malicious OilRig OAuth Application Sign-In via Azure (via azure)

This rule detects Azure AD sign-ins from the OAuth application client ID 860b23a7-d484-481d-9fea-d3e6e129e249 hardcoded in OilRig's cloud-service-powered downloaders. The group abuses this registered application to obtain tokens for Microsoft Graph and EWS based command-and-control, so any sign-in with this AppId indicates C2 activity.

Suspicious Microsoft Teams Message from External Tenant Impersonating Helpdesk

This rule detects one-on-one Microsoft Teams chat messages originating from external tenants where the sender identity references helpdesk, IT, or support, matching the helpdesk impersonation vishing technique tracked by eSentire. Attackers pose as internal support over federated Teams to socially engineer users into granting access, so external senders using these identities are a phishing indicator.

Suspicious Mailbox Forwarding Rule Creation Following AiTM Phishing

This rule detects the creation or modification of mailbox inbox rules that forward, redirect, or delete incoming messages, a common post-compromise action performed by operators of the Sneaky2FA adversary-in-the-middle phishing kit. After stealing session tokens attackers add hidden forwarding rules to maintain access to victim correspondence, so this activity is a key sign of business email compromise.

Suspicious OAuth Device Code Sign-In to Authentication Broker via Tycoon 2FA

This rule detects a successful device code authentication against the Microsoft Authentication Broker application. Tycoon 2FA operators adopted OAuth device code phishing to trick users into authorizing attacker-controlled sessions and mint long-lived tokens for non-interactive Exchange and Graph access. Device code grants to the broker app are rare in normal use and indicate token theft.

Suspicious OfficeHome Sign-In With Axios User Agent via Tycoon 2FA Proxy

This rule detects a successful Entra sign-in to the OfficeHome application originating from an axios HTTP client user agent. This pattern is characteristic of the Tycoon 2FA adversary-in-the-middle platform replaying stolen session tokens through automated proxy infrastructure rather than a real browser. A scripted axios agent authenticating interactively indicates session hijacking following a phishing capture.

Suspicious Legacy AAD Graph Enumeration With Scripting User Agent

This rule detects enumeration of users groups and service principals through the legacy Azure AD Graph API versions 1.5 and 1.6 from scripting user agents such as python aiohttp curl and Go-http-client as described in Elastic research on AAD Graph activity logs. Programmatic access to the deprecated Graph endpoint frequently reflects tenant reconnaissance rather than sanctioned application traffic.

Suspicious OAuth Sign-In Using Visual Studio Code Client and Auth Broker

This rule detects Entra ID non-interactive sign-ins where the Visual Studio Code first-party application requests a token through the Microsoft Authentication Broker resource, the exact combination abused in an OAuth phishing campaign. Attackers lure victims into authorizing this trusted client to mint refresh tokens and register rogue devices for persistent access to Microsoft Graph.

Suspicious IAM Persistence and Privilege Escalation Actions

This rule detects AWS IAM API calls commonly chained for persistence and privilege escalation, such as creating access keys, attaching policies, updating assume-role trust policies, or passing a role. Elastic highlights these actions as high-value signals when performed by unexpected principals during account compromise.

Suspicious AWS Virtual MFA Device Creation

This rule detects the CreateVirtualMFADevice API call in AWS CloudTrail, used by the DPRK cryptocurrency-heist actors to register attacker-controlled MFA devices for persistent access to compromised identities. Unexpected MFA device creation may indicate account takeover and persistence via multi-factor manipulation and should be correlated with the acting principal.

Suspicious S3 Lifecycle Policy Set for Rapid Object Deletion

This rule detects an S3 PutBucketLifecycle call that configures a short object expiration, a destructive and coercive step in the AWS S3 SSE-C ransom scenario emulated by Elastic. Attackers set an aggressive deletion timer to pressure victims and permanently remove data if the ransom is unpaid. Lifecycle changes outside of approved data management workflows should be reviewed.

Suspicious AWS STS AssumeRoot Privilege Escalation To Member Account Root

This rule detects a CloudTrail STS AssumeRoot API call which grants short lived root credentials for a member account and is a powerful privilege escalation path in AWS organizations. Adversaries with a compromised IAM principal invoke AssumeRoot to obtain root level access over a member account and expand control.

Suspicious EC2 Snapshot Attribute Modification for External Sharing via CloudTrail

This rule detects the ModifySnapshotAttribute CloudTrail event which attackers use to share an EBS snapshot with an external AWS account for data exfiltration as highlighted in this Elastic analysis. Sharing snapshots outside the organization is a low volume administrative action that when unexpected indicates exfiltration of volume data.

Suspicious GCP Service Account Impersonation via GenerateAccessToken

This rule detects use of the IAM Credentials GenerateAccessToken method, which mints short-lived access tokens for a service account through impersonation. Adversaries granted serviceAccountTokenCreator invoke this call, often via gcloud with impersonate-service-account, to act with the target service account permissions. It is important because impersonation lets an attacker operate under a more privileged identity while obscuring their originating principal.

Malicious GCP Service Account Backdoor via serviceAccountTokenCreator Grant

This rule detects a google.iam.admin.v1.SetIAMPolicy admin activity event that grants the roles/iam.serviceAccountTokenCreator role, allowing a principal to mint access tokens for a targeted service account. Adversaries use this binding to backdoor a service account and later impersonate it through GenerateAccessToken, keeping durable privileged access. This matters because the grant converts any controlled identity into a lasting path to the service account privileges.

Suspicious Cross-Project Compute Snapshot Creation via GCP Audit

This rule detects v1.compute.snapshots.insert operations that carry CrossEntityControlAuditMetadata, indicating a snapshot created across project boundaries. Adversaries copy a disk snapshot into an attacker-controlled project to exfiltrate its contents outside the victim environment. Cross-project snapshot movement is a strong indicator of cloud data theft rather than routine backup activity.