Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
28 rules
OneLogin: User Assumes Another Account via Event Type 3
Alerts on OneLogin events indicating a user assumed another user account via event_type_id 3.
Austin Songer @austinsonger, Huntrule TeamOneloginonelogin.eventsLow321Free2021-10-12Okta MFA Deactivation or Full Factor Reset Event Detection
Flags Okta events indicating MFA deactivation or reset_all actions by a user or actor.
Austin Songer @austinsonger, Huntrule TeamOktaoktaMedium477Free2021-09-21Okta User Account Lockout Triggered by Max Sign-In Attempts
Flags Okta user account lockouts triggered by exceeding the max sign-in attempts threshold.
Austin Songer @austinsonger, Huntrule TeamOktaoktaMedium222Free2021-09-12Okta: Unauthorized App Access Attempt Based on System Log Message
Alerts when Okta logs show a user attempted unauthorized access to an app.
Austin Songer @austinsonger, Huntrule TeamOktaoktaMedium493Free2021-09-12Okta: Detect security.threat.detected events in threat insight
Flags Okta System Log security.threat.detected events indicating a detected potential security threat.
Austin Songer @austinsonger, Huntrule TeamOktaoktaMedium515Free2021-09-12Okta Policy Rule Updated or Deleted
Alerts on Okta policy rule update or deletion events that may indicate tampering with authorization controls.
Austin Songer @austinsonger, Huntrule TeamOktaoktaMedium142Free2021-09-12Okta Policy Lifecycle Updated or Deleted
Flags Okta events indicating a policy was updated or deleted.
Austin Songer @austinsonger, Huntrule TeamOktaoktaLow231Free2021-09-12Okta Network Zone Deactivated or Deleted via zone.deactivate or zone.delete
Flags Okta System Log events when a Network Zone is deactivated or deleted.
Austin Songer @austinsonger, Huntrule TeamOktaoktaMedium533Free2021-09-12Okta Sign-On Policy Updated or Rule Deleted
Flags Okta sign-on policy updates and sign-on rule deletions in application policies.
Austin Songer @austinsonger, Huntrule TeamOktaoktaMedium202Free2021-09-12Okta Application Lifecycle Update or Deletion Events
Alerts on Okta application updates and deletions based on application lifecycle event types in the System Log.
Austin Songer @austinsonger, Huntrule TeamOktaoktaMedium212Free2021-09-12Okta: Detect API token revocation events
Flags Okta API token revocations using system.api_token.revoke System Log events.
Austin Songer @austinsonger, Huntrule TeamOktaoktaMedium173Free2021-09-12Okta System API Token Creation Events
Flags Okta API token creation events to support investigation of potential persistence.
Austin Songer @austinsonger, Huntrule TeamOktaoktaMedium393Free2021-09-12Okta Admin Role Granted to User or Group
Flags Okta privilege grant events that assign Administrator permissions to a user or group.
Austin Songer @austinsonger, Huntrule TeamOktaoktaMedium252Free2021-09-12