Sigma detection rules, expert-reviewed

Suspicious Azure AD MFA Fatigue Repeated Push Denials

This rule detects Entra ID sign-in events with result code 500121, which records that a multifactor authentication request was denied by the user. A burst of these denials for a single userPrincipalName indicates an MFA fatigue or push-bombing attack where an adversary holding valid credentials repeatedly prompts the victim hoping for an accidental approval. This is important because sustained denials often precede a coerced approval and account takeover.

Malicious Azure Elevate Access to User Access Administrator

This rule detects the Microsoft.Authorization/elevateAccess/action operation, which assigns the calling Global Administrator the User Access Administrator role across all Azure subscriptions in the tenant. Adversaries who compromise a Global Administrator use elevateAccess to break out of Entra ID into the Azure resource plane and take control of every subscription. This is important because it is a high-impact privilege escalation that exposes all cloud resources.

Possible Azure Storage Ransomware via Customer-Managed Key Encryption

This rule detects Azure Activity operations that rewrite storage account encryption to attacker-controlled key material, a hijack path for blob storage ransomware. Writing an encryption scope or setting the account key source to Key Vault lets an actor re-encrypt blobs under a key they hold and then deny the victim access. These control-plane encryption changes on production storage accounts warrant urgent review.

Suspicious OAuth Application Consent in Microsoft Entra

This rule detects a Consent to application event in Microsoft Entra which the CoPhish technique relies on to trick a user into granting a malicious Copilot Studio hosted OAuth application access to their tokens for account takeover.

Suspicious Azure Key Vault Access Policy Modification

This rule detects an Azure Activity Log write operation against a Key Vault which a principal holding the Microsoft.KeyVault vaults write permission can abuse to grant itself secret key and certificate data access for privilege escalation and credential theft.

Suspicious Azure Policy Definition or Assignment Modification

This rule detects Azure Activity Log write operations against policy set definitions or policy assignments which an identity holding the Resource Policy Contributor role can abuse to modify a shared policy and inherit elevated service principal permissions across all its assignments for privilege escalation.

Suspicious AWS IAM Role Creation With Cross-Account Trust Policy

This rule detects an IAM CreateRole event whose assumeRolePolicyDocument establishes a trust relationship that allows another AWS account principal to assume the role. Adversaries create such backdoored roles so an attacker-controlled external account gains persistent access into the victim environment. This is important because cross-account trust relationships are a stealthy persistence mechanism that survives credential rotation.

Possible SES Sending Configuration Enumeration via CloudTrail

This rule detects reconnaissance enumeration of Amazon SES sending configuration through GetAccountSendingEnabled, GetSendQuota, ListIdentities, and GetIdentityVerificationAttributes calls. Adversaries with stolen credentials probe SES quotas and verified identities to determine whether the account can be abused to send spam or phishing. A burst of these read calls from an unexpected principal often precedes SES abuse.

Suspicious Security Group Ingress Rule Opened to the Internet via CloudTrail

This rule detects AuthorizeSecurityGroupIngress events that add an ingress rule allowing the 0.0.0.0/0 or ::/0 CIDR range. Adversaries widen security groups to the entire internet to expose management and database service ports such as SSH, RDP, MySQL, and Redis for remote access or lateral movement. Opening a security group to any source weakens network boundaries and is a common precursor to exploitation.

Suspicious AWS Role Assumption via Cognito Web Identity

This rule detects CloudTrail AssumeRoleWithWebIdentity events whose identity provider is cognito-identity.amazonaws.com which the AWS Amplify role takeover technique abuses to assume a victim account authRole or unauthRole from an attacker controlled identity pool for cross account access.

Suspicious Scheduled Task Named WindowsHelper (via process_creation)

This rule detects schtasks creating a task named WindowsHelper. Operation HumanitarianBait registers this masqueraded task to relaunch its VBScript stager every few minutes for persistence.

Suspicious Wscript Spawning Embedded Python Interpreter (via process_creation)

This rule detects wscript.exe launching pythonw.exe, an unusual chain used by Operation HumanitarianBait. A VBScript launcher runs an embedded Python interpreter to execute the PyArmor-protected stealer module silently.

Suspicious Script Host Spawning Hidden PowerShell (via process_creation)

This rule detects wscript or cscript launching PowerShell with a hidden window. This layered email loader uses WMI-spawned hidden PowerShell to run its next stage without a visible console.

Suspicious WMIC System Reconnaissance via CSProduct UUID Query (via process_creation)

This rule detects WMIC querying the csproduct UUID for host fingerprinting. Maranhao Stealer issues this and related WMIC queries to build a unique victim identifier before exfiltration.

Suspicious VS Code Tunnel Establishment for Covert Access (via process_creation)

This rule detects code.exe creating a remote tunnel while auto-accepting the server license terms. Phantom Goblin abuses VS Code tunnels to maintain covert remote access and command channels.