Sigma detection rules, expert-reviewed

Suspicious New MFA Authenticator Registration via Azure AD (via azure)

This rule detects registration of new security information such as a Microsoft Authenticator app on an Azure AD identity, a persistence and MFA-bypass step used in the Jingle Thief campaign. The actors register a rogue authenticator to maintain access to compromised accounts. Detecting this registration surfaces attacker enrollment of unauthorized MFA methods after account takeover.

Suspicious Exchange Deletion of MFA Notification Emails

This rule detects Exchange SoftDelete and HardDelete operations that ShinyHunters actors use to remove multi factor authentication change notifications from a victim mailbox. Attackers purge these alerts to hide account takeover and MFA tampering from the legitimate user.

Suspicious AWS Virtual MFA Device Creation

This rule detects the CreateVirtualMFADevice API call in AWS CloudTrail, used by the DPRK cryptocurrency-heist actors to register attacker-controlled MFA devices for persistent access to compromised identities. Unexpected MFA device creation may indicate account takeover and persistence via multi-factor manipulation and should be correlated with the acting principal.

Suspicious AWS Console Phishing MFA Relay Endpoints

This rule detects requests to the MFA relay endpoints of the AWS console phishing kit that intercept second-factor codes delivered by email, SMS, or authenticator app. The kit prompts victims for their one-time codes and forwards them so the operator can complete authentication in real time. Traffic to these email, sms, and gauth relay paths on a login-lookalike host indicates active MFA interception.

Suspicious Azure AD MFA Fatigue Repeated Push Denials

This rule detects Entra ID sign-in events with result code 500121, which records that a multifactor authentication request was denied by the user. A burst of these denials for a single userPrincipalName indicates an MFA fatigue or push-bombing attack where an adversary holding valid credentials repeatedly prompts the victim hoping for an accidental approval. This is important because sustained denials often precede a coerced approval and account takeover.

Suspicious AWS Console Login Without MFA

This rule detects a successful AWS Management Console sign-in where additionalEventData.MFAUsed is No, indicating interactive access with only a password or root credentials and no second factor. Adversaries who compromise console credentials rely on non-MFA logins to gain hands-on-keyboard access, a pattern GuardDuty also flags as IAMUser ConsoleLoginSuccess. This is important because non-MFA console logins are a primary indicator of account takeover.

AWS CloudTrail Successful ConsoleLogin Events Without MFA

Flags successful AWS console logins with MFAUsed explicitly set to NO in CloudTrail.

Azure AD Audit: Update User Risk and MFA Registration Policy

Flags Azure AD audit events showing updates to user risk and MFA registration policy.

Cisco Duo MFA Success Triggered by Admin-Assigned Bypass Code

Alert on Duo successful MFA logins that are attributed to bypass-user codes.

Microsoft 365 Audit: Disabling Strong Authentication (MFA)

Flags Microsoft 365 audit events indicating MFA/strong authentication was disabled.

Azure PIM Role Activation Without MFA Alert (noMfaOnRoleActivationAlertIncident)

Alerts when Azure PIM signals role activation occurred without MFA.

Okta FastPass blocks phishing authentication attempts via MFA

Alerts on Okta FastPass MFA failures where the declined reason indicates a known phishing attempt.

Azure Sign-in Success with Legacy Client User-Agent Indicators (MFA Bypass Suspicion)

Alerts on successful Azure sign-ins using legacy client user-agent markers that may indicate MFA bypass attempts.

Azure Sign-In: Successful single-factor atRisk logins from non-registered devices

Alerts on at-risk successful Azure sign-ins from devices with missing trust type when MFA isn’t required.

Azure AD Sign-in Success Without MFA (Single-Factor Authentication)

Alerts on successful Azure AD sign-ins where MFA was not required and only single-factor authentication was used.