Sigma detection rules, expert-reviewed

Suspicious SNS Publish to Phone Number for Smishing

This rule detects an SNS Publish call that targets a phone number directly, a smishing abuse pattern in the AWS SNS research by Elastic. Adversaries who compromise credentials use SNS to send SMS phishing messages at scale from the victim account. Direct phone number publishes outside of known messaging workflows can indicate account abuse and outbound phishing.

Suspicious AWS SES Production Access Request via PutAccountDetails (Cloud Email Abuse)

This rule detects SES PutAccountDetails CloudTrail events that request production sending access to escape the SES sandbox, a burst of which was central to the cloud email service takeover campaign. It matters because attackers using leaked keys raise sending limits before launching large phishing campaigns.

GCP Google Workspace Suspicious Login Events (Google Classified)

Alerts on Google Workspace login audit events classified by Google as suspicious, including less secure app and programmatic login types.

Google Workspace login activity: Out-of-domain email forwarding

Flags Google Workspace out-of-domain email forwarding events from audit logs on login.googleapis.com.

Google Workspace login event flagged with gov_attack_warning

Alerts on Google Workspace login audit events marked with gov_attack_warning by Google’s risk signals.

Microsoft 365 inbound suspicious email delivered to Inbox or Junk

Alerts when Defender-labeled suspicious inbound emails are delivered to user Inbox/Junk in Microsoft 365.

AWS CloudTrail GuardDuty Detector Deleted or Disabled via UpdateDetector

Identifies successful GuardDuty detector deletion or disablement from CloudTrail, reducing GuardDuty monitoring coverage.

AWS CloudTrail: TruffleHog User-Agent Execution Detected

Flags AWS CloudTrail events with user agent "TruffleHog" to surface potential secret-scanning or credential-harvesting activity.

AWS CloudTrail Detects EC2 DeleteFlowLogs API Calls

Flags successful EC2 DeleteFlowLogs API calls in CloudTrail indicating VPC Flow Logs were removed.

AWS CloudTrail Account EnableRegion Command Usage

Alerts on AWS account region enablement via CloudTrail when the EnableRegion API call occurs.

AWS CloudTrail ConsoleLogin Failed authentication

Flags CloudTrail ConsoleLogin events with "Failed authentication" to help identify possible credential-based attacks.

AWS CloudTrail S3 DeleteBucket Events with Successful Deletion

Flags successful CloudTrail DeleteBucket events indicating an S3 bucket was removed.

AWS KMS Imported Key Material Import or Deletion via CloudTrail

Detects AWS KMS imported key material events in CloudTrail, including import and deletion of imported key material.

AWS CloudTrail Successful ConsoleLogin Events Without MFA

Flags successful AWS console logins with MFAUsed explicitly set to NO in CloudTrail.

AWS CloudTrail Detects STS GetCallerIdentity Calls with TruffleHog User-Agent

Identifies TruffleHog-labeled STS GetCallerIdentity calls in AWS CloudTrail, indicating possible AWS key validation or enumeration.