deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Google Cloud Kubernetes RoleBinding
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer @austinsonger
Date: 2021-08-09
Log source: gcp/

Description:
Detects the creation or patching of potential malicious RoleBinding. This includes RoleBindings and ClusterRoleBinding.

Detection logic:
{
  "selection": {
    "gcp.audit.method_name": [
      "io.k8s.authorization.rbac.v*.clusterrolebindings.create",
      "io.k8s.authorization.rbac.v*.rolebindings.create",
      "io.k8s.authorization.rbac.v*.clusterrolebindings.patch",
      "io.k8s.authorization.rbac.v*.rolebindings.patch",
      "io.k8s.authorization.rbac.v*.clusterrolebindings.update",
      "io.k8s.authorization.rbac.v*.rolebindings.update",
      "io.k8s.authorization.rbac.v*.clusterrolebindings.delete",
      "io.k8s.authorization.rbac.v*.rolebindings.delete"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/elastic/detection-rules/pull/1267
  - https://kubernetes.io/docs/reference/kubernetes-api/authorization-resources/cluster-role-v1/#ClusterRole
  - https://cloud.google.com/kubernetes-engine/docs/how-to/role-based-access-control
  - https://kubernetes.io/docs/reference/access-authn-authz/rbac/
  - https://cloud.google.com/kubernetes-engine/docs/how-to/audit-logging
Sigma Detection Rule: Google Cloud Storage Buckets Modified or Deleted
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer @austinsonger
Date: 2021-08-14
Log source: gcp/

Description:
Detects when storage bucket is modified or deleted in Google Cloud.

Detection logic:
{
  "selection": {
    "gcp.audit.method_name": [
      "storage.buckets.delete",
      "storage.buckets.insert",
      "storage.buckets.update",
      "storage.buckets.patch"
    ]
  },
  "condition": "selection"
}

References:
  - https://cloud.google.com/storage/docs/json_api/v1/buckets
Sigma Detection Rule: GCP Access Policy Deleted
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Bryan Lim
Date: 2024-01-12
ATT&CK techniques: T1098
Log source: gcp/

Description:
Detects when an access policy that is applied to a GCP cloud resource is deleted.
An adversary would be able to remove access policies to gain access to a GCP cloud resource.


Detection logic:
{
  "selection": {
    "data.protoPayload.authorizationInfo.permission": [
      "accesscontextmanager.accessPolicies.delete",
      "accesscontextmanager.accessPolicies.accessLevels.delete",
      "accesscontextmanager.accessPolicies.accessZones.delete",
      "accesscontextmanager.accessPolicies.authorizedOrgsDescs.delete"
    ],
    "data.protoPayload.authorizationInfo.granted": "true",
    "data.protoPayload.serviceName": "accesscontextmanager.googleapis.com"
  },
  "condition": "selection"
}

References:
  - https://cloud.google.com/access-context-manager/docs/audit-logging
  - https://cloud.google.com/logging/docs/audit/understanding-audit-logs
  - https://cloud.google.com/logging/docs/reference/audit/auditlog/rest/Shared.Types/AuditLog
Sigma Detection Rule: Google Cloud Kubernetes Secrets Modified or Deleted
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer @austinsonger
Date: 2021-08-09
Log source: gcp/

Description:
Identifies when the Secrets are Modified or Deleted.

Detection logic:
{
  "selection": {
    "gcp.audit.method_name": [
      "io.k8s.core.v*.secrets.create",
      "io.k8s.core.v*.secrets.update",
      "io.k8s.core.v*.secrets.patch",
      "io.k8s.core.v*.secrets.delete"
    ]
  },
  "condition": "selection"
}

References:
  - https://cloud.google.com/kubernetes-engine/docs/how-to/audit-logging
Sigma Detection Rule: Google Cloud VPN Tunnel Modified or Deleted
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer @austinsonger
Date: 2021-08-16
Log source: gcp/

Description:
Identifies when a VPN Tunnel Modified or Deleted in Google Cloud.

Detection logic:
{
  "selection": {
    "gcp.audit.method_name": [
      "compute.vpnTunnels.insert",
      "compute.vpnTunnels.delete"
    ]
  },
  "condition": "selection"
}

References:
  - https://any-api.com/googleapis_com/compute/docs/vpnTunnels
Sigma Detection Rule: Users Authenticating To Other Azure AD Tenants
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: MikeDuddington, '@dudders1'
Date: 2022-06-30
ATT&CK techniques: T1078.004
Log source: azure/

Description:
Detect when users in your Azure AD tenant are authenticating to other Azure AD Tenants.

Detection logic:
{
  "selection": {
    "Status": "Success",
    "HomeTenantId": "HomeTenantID"
  },
  "filter": {
    "ResourceTenantId|contains": "HomeTenantID"
  },
  "condition": "selection and not filter"
}

References:
  - https://learn.microsoft.com/en-gb/entra/architecture/security-operations-user-accounts#monitoring-external-user-sign-ins
Sigma Detection Rule: Account Disabled or Blocked for Sign in Attempts
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Yochana Henderson, '@Yochana-H'
Date: 2022-06-17
ATT&CK techniques: T1078.004
Log source: azure/

Description:
Detects when an account is disabled or blocked for sign in but tried to log in

Detection logic:
{
  "selection": {
    "ResultType": 50057,
    "ResultDescription": "Failure"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-gb/entra/architecture/security-operations-privileged-accounts
Sigma Detection Rule: Account Lockout
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: AlertIQ
Date: 2021-10-10
ATT&CK techniques: T1110
Log source: azure/

Description:
Identifies user account which has been locked because the user tried to sign in too many times with an incorrect user ID or password.

Detection logic:
{
  "selection": {
    "ResultType": 50053
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts
Sigma Detection Rule: Authentications To Important Apps Using Single Factor Authentication
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: MikeDuddington, '@dudders1'
Date: 2022-07-28
ATT&CK techniques: T1078
Log source: azure/

Description:
Detect when authentications to important application(s) only required single-factor authentication

Detection logic:
{
  "selection": {
    "Status": "Success",
    "AppId": "Insert Application ID use OR for multiple",
    "AuthenticationRequirement": "singleFactorAuthentication"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-gb/entra/architecture/security-operations-user-accounts
Sigma Detection Rule: Applications That Are Using ROPC Authentication Flow
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'
Date: 2022-06-01
ATT&CK techniques: T1078
Log source: azure/

Description:
Resource owner password credentials (ROPC) should be avoided if at all possible as this requires the user to expose their current password credentials to the application directly.
The application then uses those credentials to authenticate the user against the identity provider.


Detection logic:
{
  "selection": {
    "properties.message": "ROPC"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-authentication-flows
Sigma Detection Rule: Use of Legacy Authentication Protocols
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Yochana Henderson, '@Yochana-H'
Date: 2022-06-17
ATT&CK techniques: T1078.004, T1110
Log source: azure/

Description:
Alert on when legacy authentication has been used on an account

Detection logic:
{
  "selection": {
    "ActivityDetails": "Sign-ins",
    "ClientApp": [
      "Other client",
      "IMAP",
      "POP3",
      "MAPI",
      "SMTP",
      "Exchange ActiveSync",
      "Exchange Web Services"
    ],
    "Username": "UPN"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-gb/entra/architecture/security-operations-privileged-accounts
Sigma Detection Rule: Potential MFA Bypass Using Legacy Client Authentication
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Harjot Singh, '@cyb3rjy0t'
Date: 2023-03-20
ATT&CK techniques: T1078.004, T1110
Log source: azure/

Description:
Detects successful authentication from potential clients using legacy authentication via user agent strings. This could be a sign of MFA bypass using a password spray attack.

Detection logic:
{
  "selection": {
    "Status": "Success",
    "userAgent|contains": [
      "BAV2ROPC",
      "CBAinPROD",
      "CBAinTAR"
    ]
  },
  "condition": "selection"
}

References:
  - https://web.archive.org/web/[PII_REDACTED]1802/https://blooteem.com/march-2022
  - https://www.microsoft.com/en-us/security/blog/2021/10/26/protect-your-business-from-password-sprays-with-microsoft-dart-recommendations/
Sigma Detection Rule: Azure AD Only Single Factor Authentication Required
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: MikeDuddington, '@dudders1'
Date: 2022-07-27
ATT&CK techniques: T1078.004, T1556.006
Log source: azure/

Description:
Detect when users are authenticating without MFA being required.

Detection logic:
{
  "selection": {
    "Status": "Success",
    "AuthenticationRequirement": "singleFactorAuthentication"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-gb/entra/architecture/security-operations-user-accounts
Sigma Detection Rule: Successful Authentications From Countries You Do Not Operate Out Of
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: MikeDuddington, '@dudders1'
Date: 2022-07-28
ATT&CK techniques: T1078.004, T1110
Log source: azure/

Description:
Detect successful authentications from countries you do not operate out of.

Detection logic:
{
  "selection": {
    "Status": "Success"
  },
  "filter": {
    "Location|contains": "<Countries you DO operate out of e,g GB, use OR for multiple>"
  },
  "condition": "selection and not filter"
}

References:
  - https://learn.microsoft.com/en-gb/entra/architecture/security-operations-user-accounts
Sigma Detection Rule: Failed Authentications From Countries You Do Not Operate Out Of
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: MikeDuddington, '@dudders1'
Date: 2022-07-28
ATT&CK techniques: T1078.004, T1110
Log source: azure/

Description:
Detect failed authentications from countries you do not operate out of.

Detection logic:
{
  "selection": {
    "Status": "Success"
  },
  "selection1": {
    "Location|contains": "<Countries you DO operate out of e,g GB, use OR for multiple>"
  },
  "condition": "not selection and not selection1"
}

References:
  - https://learn.microsoft.com/en-gb/entra/architecture/security-operations-user-accounts
Sigma Detection Rule: Azure Unusual Authentication Interruption
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer @austinsonger
Date: 2021-11-26
ATT&CK techniques: T1078
Log source: azure/

Description:
Detects when there is a interruption in the authentication process.

Detection logic:
{
  "selection_50097": {
    "ResultType": 50097,
    "ResultDescription": "Device authentication is required"
  },
  "selection_50155": {
    "ResultType": 50155,
    "ResultDescription": "DeviceAuthenticationFailed"
  },
  "selection_50158": {
    "ResultType": 50158,
    "ResultDescription": "ExternalSecurityChallenge - External security challenge was not satisfied"
  },
  "condition": "1 of selection_*"
}

References:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts
Sigma Detection Rule: Login to Disabled Account
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: AlertIQ
Date: 2021-10-10
ATT&CK techniques: T1078.004
Log source: azure/

Description:
Detect failed attempts to sign in to disabled accounts.

Detection logic:
{
  "selection": {
    "ResultType": 50057,
    "ResultDescription": "User account is disabled. The account has been disabled by an administrator."
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts
Sigma Detection Rule: Application Using Device Code Authentication Flow
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'
Date: 2022-06-01
ATT&CK techniques: T1078
Log source: azure/

Description:
Device code flow is an OAuth 2.0 protocol flow specifically for input constrained devices and is not used in all environments.
If this type of flow is seen in the environment and not being used in an input constrained device scenario, further investigation is warranted.
This can be a misconfigured application or potentially something malicious.


Detection logic:
{
  "selection": {
    "properties.message": "Device Code"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-authentication-flows
Sigma Detection Rule: Increased Failed Authentications Of Any Type
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Mark Morowczynski '@markmorow', MikeDuddington, '@dudders1'
Date: 2022-08-11
ATT&CK techniques: T1078
Log source: azure/

Description:
Detects when sign-ins increased by 10% or greater.

Detection logic:
{
  "selection": {
    "Status": "failure",
    "Count": "<10%"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#monitoring-for-failed-unusual-sign-ins
Sigma Detection Rule: Sign-ins by Unknown Devices
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Michael Epping, '@mepples21'
Date: 2022-06-28
ATT&CK techniques: T1078.004
Log source: azure/

Description:
Monitor and alert for Sign-ins by unknown devices from non-Trusted locations.

Detection logic:
{
  "selection": {
    "AuthenticationRequirement": "singleFactorAuthentication",
    "ResultType": 0,
    "NetworkLocationDetails": "[]",
    "DeviceDetail.deviceId": ""
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-devices#non-compliant-device-sign-in
Sigma Detection Rule: Device Registration or Join Without MFA
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Michael Epping, '@mepples21'
Date: 2022-06-28
ATT&CK techniques: T1078.004
Log source: azure/

Description:
Monitor and alert for device registration or join events where MFA was not performed.

Detection logic:
{
  "selection": {
    "ResourceDisplayName": "Device Registration Service",
    "conditionalAccessStatus": "success"
  },
  "filter_mfa": {
    "AuthenticationRequirement": "multiFactorAuthentication"
  },
  "condition": "selection and not filter_mfa"
}

References:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-devices#device-registrations-and-joins-outside-policy
Sigma Detection Rule: Discovery Using AzureHound
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Janantha Marasinghe
Date: 2022-11-27
ATT&CK techniques: T1087.004, T1526
Log source: azure/

Description:
Detects AzureHound (A BloodHound data collector for Microsoft Azure) activity via the default User-Agent that is used during its operation after successful authentication.

Detection logic:
{
  "selection": {
    "userAgent|contains": "azurehound",
    "ResultType": 0
  },
  "condition": "selection"
}

References:
  - https://github.com/BloodHoundAD/AzureHound
Sigma Detection Rule: Sign-in Failure Due to Conditional Access Requirements Not Met
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Yochana Henderson, '@Yochana-H'
Date: 2022-06-01
ATT&CK techniques: T1110, T1078.004
Log source: azure/

Description:
Define a baseline threshold for failed sign-ins due to Conditional Access failures

Detection logic:
{
  "selection": {
    "ResultType": 53003,
    "Resultdescription": "Blocked by Conditional Access"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-gb/entra/architecture/security-operations-privileged-accounts
Sigma Detection Rule: Suspicious SignIns From A Non Registered Device
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Harjot Singh, '@cyb3rjy0t'
Date: 2023-01-10
ATT&CK techniques: T1078
Log source: azure/

Description:
Detects risky authentication from a non AD registered device without MFA being required.

Detection logic:
{
  "selection_main": {
    "Status": "Success",
    "AuthenticationRequirement": "singleFactorAuthentication",
    "RiskState": "atRisk"
  },
  "selection_empty1": {
    "DeviceDetail.trusttype": ""
  },
  "selection_empty2": {
    "DeviceDetail.trusttype": null
  },
  "condition": "selection_main and 1 of selection_empty*"
}

References:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-devices#non-compliant-device-sign-in
Sigma Detection Rule: User Access Blocked by Azure Conditional Access
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: AlertIQ
Date: 2021-10-10
ATT&CK techniques: T1110, T1078.004
Log source: azure/

Description:
Detect access has been blocked by Conditional Access policies.
The access policy does not allow token issuance which might be sights≈ of unauthorizeed login to valid accounts.


Detection logic:
{
  "selection": {
    "ResultType": 53003
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts
Sigma Detection Rule: Multifactor Authentication Denied
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: AlertIQ
Date: 2022-03-24
ATT&CK techniques: T1078.004, T1110, T1621
Log source: azure/

Description:
User has indicated they haven't instigated the MFA prompt and could indicate an attacker has the password for the account.

Detection logic:
{
  "selection": {
    "AuthenticationRequirement": "multiFactorAuthentication",
    "Status|contains": "MFA Denied"
  },
  "condition": "selection"
}

References:
  - https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
Sigma Detection Rule: Sign-ins from Non-Compliant Devices
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Michael Epping, '@mepples21'
Date: 2022-06-28
ATT&CK techniques: T1078.004
Log source: azure/

Description:
Monitor and alert for sign-ins where the device was non-compliant.

Detection logic:
{
  "selection": {
    "DeviceDetail.isCompliant": "false"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-devices#non-compliant-device-sign-in
Sigma Detection Rule: Measurable Increase Of Successful Authentications
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Mark Morowczynski '@markmorow', MikeDuddington, '@dudders1', Tim Shelton
Date: 2022-08-11
ATT&CK techniques: T1078
Log source: azure/

Description:
Detects when successful sign-ins increased by 10% or greater.

Detection logic:
{
  "selection": {
    "Status": "Success",
    "Count": "<10%"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#monitoring-for-successful-unusual-sign-ins
Sigma Detection Rule: Multifactor Authentication Interrupted
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: AlertIQ
Date: 2021-10-10
ATT&CK techniques: T1078.004, T1110, T1621
Log source: azure/

Description:
Identifies user login with multifactor authentication failures, which might be an indication an attacker has the password for the account but can't pass the MFA challenge.

Detection logic:
{
  "selection_50074": {
    "ResultType": 50074,
    "ResultDescription|contains": "Strong Auth required"
  },
  "selection_500121": {
    "ResultType": 500121,
    "ResultDescription|contains": "Authentication failed during strong authentication request"
  },
  "condition": "1 of selection_*"
}

References:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts
Sigma Detection Rule: User Risk and MFA Registration Policy Updated
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Harjot Singh (@cyb3rjy0t)
Date: 2024-08-13
Log source: azure/

Description:
Detects changes and updates to the user risk and MFA registration policy.
Attackers can modified the policies to Bypass MFA, weaken security thresholds, facilitate further attacks, maintain persistence.


Detection logic:
{
  "selection": {
    "LoggedByService": "AAD Management UX",
    "Category": "Policy",
    "OperationName": "Update User Risk and MFA Registration Policy"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/entra/id-protection/howto-identity-protection-configure-mfa-policy
  - https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
Sigma Detection Rule: Guest User Invited By Non Approved Inviters
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H'
Date: 2022-08-10
ATT&CK techniques: T1078.004
Log source: azure/

Description:
Detects when a user that doesn't have permissions to invite a guest user attempts to invite one.

Detection logic:
{
  "selection": {
    "properties.message": "Invite external user",
    "Status": "failure"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts#things-to-monitor
Sigma Detection Rule: Temporary Access Pass Added To An Account
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H'
Date: 2022-08-10
ATT&CK techniques: T1078.004
Log source: azure/

Description:
Detects when a temporary access pass (TAP) is added to an account. TAPs added to priv accounts should be investigated

Detection logic:
{
  "selection": {
    "properties.message": "Admin registered security info",
    "Status": "Admin registered temporary access pass method for user"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts#changes-to-privileged-accounts
Sigma Detection Rule: Bulk Deletion Changes To Privileged Account Permissions
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H'
Date: 2022-08-05
ATT&CK techniques: T1098
Log source: azure/

Description:
Detects when a user is removed from a privileged role. Bulk changes should be investigated.

Detection logic:
{
  "selection": {
    "properties.message": [
      "Remove eligible member (permanent)",
      "Remove eligible member (eligible)"
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-identity-management#azure-ad-roles-assignment
Sigma Detection Rule: Added Credentials to Existing Application
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'
Date: 2022-05-26
ATT&CK techniques: T1098.001
Log source: azure/

Description:
Detects when a new credential is added to an existing application. Any additional credentials added outside of expected processes could be a malicious actor using those credentials.

Detection logic:
{
  "selection": {
    "properties.message": [
      "Update application \u2013 Certificates and secrets management",
      "Update Service principal/Update Application"
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-credentials