Sigma detection rules, expert-reviewed

Suspicious AWS Inline Policy Granting Full S3 Access

This rule detects a PutUserPolicy call that attaches an inline IAM policy granting s3 wildcard permissions to a user. It maps to privilege escalation observed in S3 attack chains where an operator self-grants full bucket access before collection. Detecting it exposes IAM policy tampering aimed at cloud data theft.

Suspicious AWS Federated Console Login From Programmatic Credentials

This rule detects an AWS Management Console sign-in performed by a federated user identity which indicates a session created from long-term or temporary programmatic credentials rather than an IAM user or SSO login. Wiz shows attackers exchange stolen keys for a federated console session to obfuscate their real identity and break session traceability. This matters because it lets an adversary operate interactively in the console while evading the account owner attribution normally provided by ConsoleLogin.

Suspicious GCP Service Account Key Creation for Persistence (via gcp.audit)

This rule detects the CreateServiceAccountKey method in GCP audit logs, the persistence technique Red Canary described where a service account creates a new key for itself to survive key-deletion remediation. Because these tokens are not revokable, key creation where the requesting principal matches the target service account is a strong sign of an actor establishing durable access.

Malicious Exchange Inbox Rule Hiding Workday Payroll Notifications via Payroll Pirate Compromise (via m365)

This rule detects creation or modification of Exchange Online inbox rules that filter messages from myworkday.com and delete or move them to obscure folders. This behavior is associated with payroll pirate campaigns against US universities where attackers hide Workday payroll and direct deposit change notifications from compromised victims. Concealing these alerts lets attackers reroute salary payments without the victim noticing, making early detection critical.

Suspicious Device Registration Following OAuth Token Theft

This rule detects Entra ID device registration and Primary Refresh Token acquisition activity consistent with the ROADtools tradecraft used after OAuth phishing. Registering an attacker-controlled device lets the adversary obtain a PRT and maintain durable access to the tenant beyond the stolen refresh token.

Suspicious EBS Snapshot Shared With External Account via CloudTrail

This rule detects ModifySnapshotAttribute events that add CREATE_VOLUME_PERMISSION for a specific external AWS account, sharing an EBS snapshot outside the owner account. Adversaries share a snapshot they created with an attacker-controlled account so they can restore the volume elsewhere and exfiltrate its data. Externally sharing a snapshot bypasses direct data reads and is a known cloud exfiltration technique.

Malicious Mailbox Forwarding Rule Creation (via exchange)

This rule detects creation or modification of a mailbox rule that auto-forwards or redirects mail to an external address, a collection-and-exfiltration technique adversaries use after compromising an account to silently siphon correspondence. Malicious email rules are a recurring identity threat in the Red Canary Threat Detection Report, often following business email compromise. Detecting forwarding-rule creation surfaces data theft that victims rarely notice.

Suspicious Entra ID Device Code Flow Authentication

This rule detects Entra ID sign-ins performed through the OAuth device code flow which threat actors abuse in device code phishing campaigns to trick users into authorizing attacker-controlled sessions and obtain tokens for apps such as Azure AD PowerShell and the Microsoft Authentication Broker. Device code authentications with inconsistent user agent and location across a shared session are a hallmark of this phishing technique.

Malicious Credential Added to an Azure AD Application (via auditlogs)

This rule detects a password or key credential being added to an Azure AD application or service principal, an account-manipulation technique that grants an attacker persistent, app-based access to a tenant. Adding application credentials is tracked in the Red Canary Threat Detection Report cloud coverage. Detecting this operation surfaces a stealthy tenant backdoor being created.

Suspicious AWS Large GPU Instance Launch via CloudTrail (via aws)

This rule detects the launch of large accelerated GPU EC2 instances recorded in CloudTrail. The intrusion abused stolen administrator access to run expensive p4d GPU instances for resource hijacking. Sudden launches of high cost GPU instance types outside of sanctioned workloads can indicate cloud resource abuse.

Suspicious EC2 Serial Console SSH Public Key Push (via cloudtrail)

This rule detects the SendSerialConsoleSSHPublicKey call used to push an SSH key to an instance serial console, an uncommon access path adversaries leverage to reach hosts that block normal network SSH. Legitimate serial console use is rare, so this event strongly suggests an attacker seeking out of band interactive access to a cloud instance.

Uncommon Security Info Registration Following AiTM Session Theft (via azure)

This rule detects a user registering new security info in Entra ID, the persistence step attackers take after adversary-in-the-middle session theft to enroll their own MFA method on a compromised account. Adversaries register a controlled authenticator to retain access after the stolen session expires, making this a useful signal when correlated with anomalous or geo-infeasible sign-ins from the same account.

Suspicious M365 Legacy Authentication via BAV2ROPC Client via m365

This rule detects non-interactive Microsoft 365 sign-ins using the BAV2ROPC legacy authentication client. In the Railway PaaS token replay campaign, operators used BAV2ROPC to silently refresh stolen tokens and access mailboxes without triggering interactive MFA, so this client string on sign-ins indicates likely token abuse and legacy protocol exploitation.

Suspicious Entra Cross-Tenant Access or External User Invitation via Azure Audit (via azure)

This rule detects Entra ID operations that add cross-tenant partners, invite external users, or create access packages, overlooked entry points into Microsoft Azure that adversaries abuse for persistence per Red Canary. These identity changes can silently grant outside principals durable access to a tenant, so unexpected occurrences should be validated against approved administrative activity.

Suspicious AWS Long-Term Access Key Creation for Persistence via CloudTrail (via aws)

This rule detects the creation of a long-term IAM access key, which adversaries generate as a backup AKIA credential to maintain persistent access to a compromised AWS account per Red Canary. Key creation for a user other than the caller, or immediately following STS token abuse, is a strong indicator that an attacker is establishing durable persistence.