Sigma detection rules, expert-reviewed

Suspicious Azure Network Security Group Rule Opening Inbound Access to the Internet

This rule detects a Microsoft.Network/networkSecurityGroups/securityRules/write operation that creates an allow inbound rule with an unrestricted source, exposing resources to the entire Internet. Adversaries modify NSG rules to open management ports or services for later remote access after gaining cloud control-plane permissions. This is important because Internet-exposed inbound rules sharply increase attack surface and often precede lateral movement or data access.

Suspicious Azure AD MFA Fatigue Repeated Push Denials

This rule detects Entra ID sign-in events with result code 500121, which records that a multifactor authentication request was denied by the user. A burst of these denials for a single userPrincipalName indicates an MFA fatigue or push-bombing attack where an adversary holding valid credentials repeatedly prompts the victim hoping for an accidental approval. This is important because sustained denials often precede a coerced approval and account takeover.

Malicious Azure Elevate Access to User Access Administrator

This rule detects the Microsoft.Authorization/elevateAccess/action operation, which assigns the calling Global Administrator the User Access Administrator role across all Azure subscriptions in the tenant. Adversaries who compromise a Global Administrator use elevateAccess to break out of Entra ID into the Azure resource plane and take control of every subscription. This is important because it is a high-impact privilege escalation that exposes all cloud resources.

Possible Azure Storage Ransomware via Customer-Managed Key Encryption

This rule detects Azure Activity operations that rewrite storage account encryption to attacker-controlled key material, a hijack path for blob storage ransomware. Writing an encryption scope or setting the account key source to Key Vault lets an actor re-encrypt blobs under a key they hold and then deny the victim access. These control-plane encryption changes on production storage accounts warrant urgent review.

Suspicious OAuth Application Consent in Microsoft Entra

This rule detects a Consent to application event in Microsoft Entra which the CoPhish technique relies on to trick a user into granting a malicious Copilot Studio hosted OAuth application access to their tokens for account takeover.

Suspicious Azure Key Vault Access Policy Modification

This rule detects an Azure Activity Log write operation against a Key Vault which a principal holding the Microsoft.KeyVault vaults write permission can abuse to grant itself secret key and certificate data access for privilege escalation and credential theft.

Suspicious Azure Policy Definition or Assignment Modification

This rule detects Azure Activity Log write operations against policy set definitions or policy assignments which an identity holding the Resource Policy Contributor role can abuse to modify a shared policy and inherit elevated service principal permissions across all its assignments for privilege escalation.

Suspicious AWS IAM Role Creation With Cross-Account Trust Policy

This rule detects an IAM CreateRole event whose assumeRolePolicyDocument establishes a trust relationship that allows another AWS account principal to assume the role. Adversaries create such backdoored roles so an attacker-controlled external account gains persistent access into the victim environment. This is important because cross-account trust relationships are a stealthy persistence mechanism that survives credential rotation.

Possible SES Sending Configuration Enumeration via CloudTrail

This rule detects reconnaissance enumeration of Amazon SES sending configuration through GetAccountSendingEnabled, GetSendQuota, ListIdentities, and GetIdentityVerificationAttributes calls. Adversaries with stolen credentials probe SES quotas and verified identities to determine whether the account can be abused to send spam or phishing. A burst of these read calls from an unexpected principal often precedes SES abuse.

Suspicious Security Group Ingress Rule Opened to the Internet via CloudTrail

This rule detects AuthorizeSecurityGroupIngress events that add an ingress rule allowing the 0.0.0.0/0 or ::/0 CIDR range. Adversaries widen security groups to the entire internet to expose management and database service ports such as SSH, RDP, MySQL, and Redis for remote access or lateral movement. Opening a security group to any source weakens network boundaries and is a common precursor to exploitation.

Suspicious AWS Role Assumption via Cognito Web Identity

This rule detects CloudTrail AssumeRoleWithWebIdentity events whose identity provider is cognito-identity.amazonaws.com which the AWS Amplify role takeover technique abuses to assume a victim account authRole or unauthRole from an attacker controlled identity pool for cross account access.

Suspicious SCATTERED SPIDER Exchange Transport Rule Creation to Suppress Alerts (via m365)

This rule detects creation or modification of Exchange Online transport rules. SCATTERED SPIDER created transport rules to delete or redirect security notification emails so that suspicious-activity alerts never reached defenders. Attacker-created mail-flow rules that hide alerting are a strong evasion signal.

Suspicious MURKY PANDA Mail Permission Grant to Service Principal (via azure)

This rule detects an application role assignment being granted to a service principal in Microsoft Entra ID. MURKY PANDA assigned Microsoft Graph mail permissions to compromised service principals to read victim mailboxes over a trusted application identity. Newly granted high-privilege app roles warrant review.

Suspicious MURKY PANDA Credential Addition to Entra ID Service Principal (via azure)

This rule detects credentials being added to an existing Microsoft Entra ID service principal. MURKY PANDA injected new secrets into legitimate service principals to establish stealthy cross-tenant cloud persistence. Unexpected credential additions to application identities can indicate abuse of trusted relationships.

Suspicious Inbox Rule Creation With Forwarding or Deletion via M365 Exchange

This rule detects the creation or modification of a mailbox inbox rule that forwards, redirects, or deletes messages within Microsoft 365 Exchange, matching the mail-exfiltration tradecraft of the ARToken EvilTokens affiliate panel reported by Cisco Talos. After token theft the operators plant inbox rules to silently siphon or hide victim mail. This behavior signals attacker persistence and collection inside a compromised tenant.