Sigma detection rules, expert-reviewed

Suspicious Google Cloud Function Create or Update Triggering Build

This rule detects creation or modification of a Google Cloud Function which automatically triggers a build using the default Cloud Build service account. Talos observed this serverless attack vector where an actor deploys a malicious function to execute attacker code during the build and inherit the over-privileged build service account, so unexpected function writes warrant review as a privilege-escalation foothold.

Malicious Assignment of a Privileged Azure AD Role (via auditlogs)

This rule detects an account being added to a privileged Azure AD directory role such as Global Administrator or Privileged Role Administrator, an account-manipulation technique used to escalate and entrench control of a tenant. Privileged role assignment is tracked in the Red Canary Threat Detection Report cloud coverage. Detecting this operation surfaces privilege escalation in the identity plane.

Suspicious Email-Hiding Inbox Rule Creation (via exchange)

This rule detects creation of a mailbox rule that automatically deletes messages or moves them to obscure folders such as RSS Feeds or Junk, a defense-evasion behavior adversaries use to hide security alerts and their own correspondence after account compromise. Email-hiding rules feature in the Red Canary Threat Detection Report as a post-compromise persistence and evasion tactic in business email compromise. Detecting these rules surfaces attacker efforts to stay unnoticed.

Malicious Mailbox Audit Bypass Association in Exchange Online (via exchange)

This rule detects an account being added to the mailbox audit bypass list, which stops Exchange from logging that account's mailbox actions, a defense-evasion technique used to hide mailbox access and rule creation. Mailbox audit bypass is tracked in the Red Canary Threat Detection Report cloud coverage. Detecting this operation surfaces an attacker suppressing mailbox telemetry.

Suspicious IAM Access Key Creation for Persistence (via cloudtrail)

This rule detects creation of a new IAM access key, a cloud account-manipulation technique attackers use to establish durable programmatic access to an AWS account after compromising a principal. Adding access keys for persistence is tracked in the Red Canary Threat Detection Report cloud coverage. Detecting the CreateAccessKey call surfaces a potential backdoor credential being minted.

Malicious OAuth Application Granted Full Mailbox and EWS Permissions (via m365)

This rule detects OAuth application permission grants for high privilege mailbox scopes such as full_access_as_app EWS.AccessAsUser.All and ApplicationImpersonation. Midnight Blizzard granted these permissions to attacker-controlled applications to access mailboxes across the tenant.

Suspicious Compute Disk IAM Policy Modification Granting Owner Role via GCP Audit

This rule detects v1.compute.disks.setIamPolicy operations that modify the IAM policy on a Compute Engine disk. Adversaries bind privileged roles such as roles/owner to an external principal to share a disk out of the victim project for data exfiltration. Granting broad access to a disk resource enables theft of the data stored on it without directly reading the volume.

Possible Credential Stuffing Blocked by Conditional Access in Microsoft 365

This rule detects Microsoft 365 sign-in events blocked by Conditional Access after a valid password was supplied, which can indicate credential stuffing or password spraying against accounts protected only by MFA. Huntress observed adversaries validating stolen credentials from VPN, Tor, and proxy sources before attempting session takeover. A spike of these blocks from anomalous geographies surfaces pre-MFA account compromise that would otherwise be silent.

Malicious Office 365 Email Rule Breach - On Behalf (via office365)

This rule detects attempt to hide emails in order to perform phishing attacks by replacing, for example, financial information from the original email with another email containing attacker's financial information. This technique may also be used to avoid specific email notification to be received by end users in case, for example, of an ongoing breach.

Suspicious IAM AdministratorAccess Policy Attachment via CloudTrail (via cloudtrail)

This rule detects the Shai Hulud privilege escalation in AWS where a freshly created IAM user is granted the AdministratorAccess managed policy through an AttachUserPolicy call. Attaching full administrator rights to a user is a high impact action that is rare in normal operations. It followed the creation of a cloudops-monitor identity.

Suspicious AWS Administrator Policy Attachment via CloudTrail (via aws)

This rule detects the attachment of the administrator access managed policy to an IAM user in CloudTrail. During the intrusion the attacker created a backdoor admin user and attached administrator access to retain full control of the account. Administrator policy attachments should be reconciled against approved access change requests.

Suspicious AWS SSO Account Role Enumeration via ListAccountRoles (via cloudtrail)

This rule detects the AWS SSO ListAccountRoles call, the reconnaissance step Red Canary noted adversaries performing after obtaining a cached SSO access token to enumerate assignable roles. A burst of ListAccountRoles from an unfamiliar source can indicate an actor mapping available roles before assuming credentials.

Suspicious AWS EC2 RunInstances of Large Compute-Optimized Instance for Cryptomining

This rule detects EC2 RunInstances launching oversized compute-optimized instance types such as c5a.24xlarge, matching the resource hijacking behavior of exposed IAM key operators tracked by Unit 42. Adversaries spin up high-core instances to maximize cryptomining throughput which drives sudden cloud spend and indicates account compromise.

Suspicious SES Account Sending Enablement and Identity Verification via CloudTrail

This rule detects UpdateAccountSendingEnabled and VerifyEmailIdentity events against Amazon SES. Adversaries who compromise valid AWS credentials verify new sending identities and re-enable account sending so they can abuse SES to distribute spam or phishing from the victim account. Re-enabling sending and verifying new identities together is characteristic of SES abuse rather than normal onboarding.

Possible Stolen AWS Credential Validation via STS GetCallerIdentity

This rule detects AWS STS GetCallerIdentity calls which the Hugging Face breach actor issued to validate stolen cloud credentials after harvesting secrets from a compromised AI agent environment. Identity self-checks are a common first move once keys are obtained. Because legitimate automation also calls this API, baseline expected principals and alert on unfamiliar or first-seen callers.