Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
21 rules
Azure Sign-In Logs: Device Registration or Join Success Without MFA
Flags successful device registration/join attempts in Azure when MFA was not performed per Conditional Access.
Michael Epping, '@mepples21', Huntrule TeamAzuresigninlogsMedium292Free2022-06-28Azure Sign-in Logs: MFA Denied Based on Authentication Requirement
Flags Azure sign-ins requiring MFA where the status indicates "MFA Denied."
AlertIQ, Huntrule TeamAzuresigninlogsMedium283Free2022-03-24Azure Audit Logs: Successful Disable Strong Authentication Indicates MFA Disabled
Alerts on successful MFA disable actions in Azure audit logs that could weaken account authentication.
"@ionsor, Huntrule Team"AzureauditlogsMedium203Free2022-02-08Azure Sign-in Log MFA Interrupted via Strong Auth Failures
Identifies Azure sign-ins that fail during strong/MFA authentication, suggesting blocked credential attempts.
AlertIQ, Huntrule TeamAzuresigninlogsMedium355Free2021-10-10Okta MFA Deactivation or Full Factor Reset Event Detection
Flags Okta events indicating MFA deactivation or reset_all actions by a user or actor.
Austin Songer @austinsonger, Huntrule TeamOktaoktaMedium497Free2021-09-21Google Workspace: Admin audit events where strong authentication is allowed without enforcement (MFA disabled)
Alerts on Google Workspace admin changes that set strong authentication/MFA enforcement to false.
Austin Songer, Huntrule TeamGcpgoogle_workspace.adminMedium592Free2021-08-26