deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: End User Consent Blocked
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow'
Date: 2022-07-10
ATT&CK techniques: T1528
Log source: azure/

Description:
Detects when end user consent is blocked due to risk-based consent.

Detection logic:
{
  "selection": {
    "failure_status_reason": "Microsoft.online.Security.userConsentBlockedForRiskyAppsExceptions"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#end-user-stopped-due-to-risk-based-consent
Sigma Detection Rule: End User Consent
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow'
Date: 2022-07-28
ATT&CK techniques: T1528
Log source: azure/

Description:
Detects when an end user consents to an application

Detection logic:
{
  "selection": {
    "ConsentContext.IsAdminConsent": "false"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#end-user-consent
Sigma Detection Rule: PIM Approvals And Deny Elevation
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H'
Date: 2022-08-09
ATT&CK techniques: T1078.004
Log source: azure/

Description:
Detects when a PIM elevation is approved or denied. Outside of normal operations should be investigated.

Detection logic:
{
  "selection": {
    "properties.message": "Request Approved/Denied"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-identity-management#azure-ad-roles-assignment
Sigma Detection Rule: Certificate-Based Authentication Enabled
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Harjot Shah Singh, '@cyb3rjy0t'
Date: 2024-03-26
ATT&CK techniques: T1556
Log source: azure/

Description:
Detects when certificate based authentication has been enabled in an Azure Active Directory tenant.

Detection logic:
{
  "selection": {
    "OperationName": "Authentication Methods Policy Update",
    "TargetResources.modifiedProperties|contains": "AuthenticationMethodsPolicy"
  },
  "condition": "selection"
}

References:
  - https://posts.specterops.io/passwordless-persistence-and-privilege-escalation-in-azure-98a01310be3f
  - https://goodworkaround.com/2022/02/15/digging-into-azure-ad-certificate-based-authentication/
Sigma Detection Rule: User State Changed From Guest To Member
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: MikeDuddington, '@dudders1'
Date: 2022-06-30
ATT&CK techniques: T1078.004
Log source: azure/

Description:
Detects the change of user type from "Guest" to "Member" for potential elevation of privilege.

Detection logic:
{
  "selection": {
    "Category": "UserManagement",
    "OperationName": "Update user",
    "properties.message": "\"displayName\":\"UserType\",\"oldValue\":\"[\\\"Guest\\\"]\",\"newValue\":\"[\\\"Member\\\"]\""
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-gb/entra/architecture/security-operations-user-accounts#monitoring-external-user-sign-ins
Sigma Detection Rule: Bitlocker Key Retrieval
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Michael Epping, '@mepples21'
Date: 2022-06-28
ATT&CK techniques: T1078.004
Log source: azure/

Description:
Monitor and alert for Bitlocker key retrieval.

Detection logic:
{
  "selection": {
    "Category": "KeyManagement",
    "OperationName": "Read BitLocker key"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-devices#bitlocker-key-retrieval
Sigma Detection Rule: New Root Certificate Authority Added
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Harjot Shah Singh, '@cyb3rjy0t'
Date: 2024-03-26
ATT&CK techniques: T1556
Log source: azure/

Description:
Detects newly added root certificate authority to an AzureAD tenant to support certificate based authentication.

Detection logic:
{
  "selection": {
    "OperationName": "Set Company Information",
    "TargetResources.modifiedProperties.newValue|contains": "TrustedCAsForPasswordlessAuth"
  },
  "condition": "selection"
}

References:
  - https://posts.specterops.io/passwordless-persistence-and-privilege-escalation-in-azure-98a01310be3f
  - https://goodworkaround.com/2022/02/15/digging-into-azure-ad-certificate-based-authentication/
Sigma Detection Rule: App Granted Microsoft Permissions
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow'
Date: 2022-07-10
ATT&CK techniques: T1528
Log source: azure/

Description:
Detects when an application is granted delegated or app role permissions for Microsoft Graph, Exchange, Sharepoint, or Azure AD

Detection logic:
{
  "selection": {
    "properties.message": [
      "Add delegated permission grant",
      "Add app role assignment to service principal"
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-granted-highly-privileged-permissions
Sigma Detection Rule: Change to Authentication Method
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: AlertIQ
Date: 2021-10-10
ATT&CK techniques: T1556, T1098
Log source: azure/

Description:
Change to authentication method could be an indicator of an attacker adding an auth method to the account so they can have continued access.

Detection logic:
{
  "selection": {
    "LoggedByService": "Authentication Methods",
    "Category": "UserManagement",
    "OperationName": "User registered security info"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts
Sigma Detection Rule: Azure Subscription Permission Elevation Via AuditLogs
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Austin Songer @austinsonger
Date: 2021-11-26
ATT&CK techniques: T1078
Log source: azure/

Description:
Detects when a user has been elevated to manage all Azure Subscriptions.
This change should be investigated immediately if it isn't planned.
This setting could allow an attacker access to Azure subscriptions in your environment.


Detection logic:
{
  "selection": {
    "Category": "Administrative",
    "OperationName": "Assigns the caller to user access admin"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts#assignment-and-elevation
Sigma Detection Rule: User Removed From Group With CA Policy Modification Access
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Mark Morowczynski '@markmorow', Thomas Detzner '@tdetzner'
Date: 2022-08-04
ATT&CK techniques: T1548, T1556
Log source: azure/

Description:
Monitor and alert on group membership removal of groups that have CA policy modification access

Detection logic:
{
  "selection": {
    "properties.message": "Remove member from group"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-infrastructure#conditional-access
Sigma Detection Rule: Application URI Configuration Changes
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'
Date: 2022-06-02
ATT&CK techniques: T1528, T1078.004
Log source: azure/

Description:
Detects when a configuration change is made to an applications URI.
URIs for domain names that no longer exist (dangling URIs), not using HTTPS, wildcards at the end of the domain, URIs that are no unique to that app, or URIs that point to domains you do not control should be investigated.


Detection logic:
{
  "selection": {
    "properties.message": "Update Application Sucess- Property Name AppAddress"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-configuration-changes
Sigma Detection Rule: Password Reset By User Account
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: YochanaHenderson, '@Yochana-H'
Date: 2022-08-03
ATT&CK techniques: T1078.004
Log source: azure/

Description:
Detect when a user has reset their password in Azure AD

Detection logic:
{
  "selection": {
    "Category": "UserManagement",
    "Status": "Success",
    "Initiatedby": "UPN"
  },
  "filter": {
    "Target|contains": "UPN",
    "ActivityType|contains": "Password reset"
  },
  "condition": "selection and filter"
}

References:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts
Sigma Detection Rule: Account Created And Deleted Within A Close Time Frame
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Mark Morowczynski '@markmorow', MikeDuddington, '@dudders1', Tim Shelton
Date: 2022-08-11
ATT&CK techniques: T1078
Log source: azure/

Description:
Detects when an account was created and deleted in a short period of time.

Detection logic:
{
  "selection": {
    "properties.message": [
      "Add user",
      "Delete user"
    ],
    "Status": "Success"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#short-lived-accounts
Sigma Detection Rule: App Assigned To Azure RBAC/Microsoft Entra Role
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow'
Date: 2022-07-19
ATT&CK techniques: T1098.003
Log source: azure/

Description:
Detects when an app is assigned Azure AD roles, such as global administrator, or Azure RBAC roles, such as subscription owner.

Detection logic:
{
  "selection": {
    "targetResources.type": "Service Principal",
    "properties.message": [
      "Add member to role",
      "Add eligible member to role",
      "Add scoped member to role"
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#service-principal-assigned-to-a-role
Sigma Detection Rule: Changes To PIM Settings
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H'
Date: 2022-08-09
ATT&CK techniques: T1078.004
Log source: azure/

Description:
Detects when changes are made to PIM roles

Detection logic:
{
  "selection": {
    "properties.message": "Update role setting in PIM"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-identity-management#azure-ad-roles-assignment
Sigma Detection Rule: CA Policy Removed by Non Approved Actor
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Corissa Koopmans, '@corissalea'
Date: 2022-07-19
ATT&CK techniques: T1548, T1556
Log source: azure/

Description:
Monitor and alert on conditional access changes where non approved actor removed CA Policy.

Detection logic:
{
  "selection": {
    "properties.message": "Delete conditional access policy"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-infrastructure#conditional-access
Sigma Detection Rule: Multi Factor Authentication Disabled For User Account
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Harjot Singh (@cyb3rjy0t)
Date: 2024-08-21
Log source: azure/

Description:
Detects changes to the "StrongAuthenticationRequirement" value, where the state is set to "0" or "Disabled".
Threat actors were seen disabling multi factor authentication for users in order to maintain or achieve access to the account. Also see in SIM Swap attacks.


Detection logic:
{
  "selection": {
    "LoggedByService": "Core Directory",
    "Category": "UserManagement",
    "OperationName": "Update user",
    "TargetResources.ModifiedProperties.DisplayName": "StrongAuthenticationRequirement",
    "TargetResources.ModifiedProperties.NewValue|contains": "State\":0"
  },
  "condition": "selection"
}

References:
  - https://www.sans.org/blog/defending-against-scattered-spider-and-the-com-with-cybercrime-intelligence/
Sigma Detection Rule: Guest Users Invited To Tenant By Non Approved Inviters
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: MikeDuddington, '@dudders1'
Date: 2022-07-28
ATT&CK techniques: T1078
Log source: azure/

Description:
Detects guest users being invited to tenant by non-approved inviters

Detection logic:
{
  "selection": {
    "Category": "UserManagement",
    "OperationName": "Invite external user"
  },
  "filter": {
    "InitiatedBy|contains": "<approved guest inviter use OR for multiple>"
  },
  "condition": "selection and not filter"
}

References:
  - https://learn.microsoft.com/en-gb/entra/architecture/security-operations-user-accounts#monitoring-external-user-sign-ins
Sigma Detection Rule: New CA Policy by Non-approved Actor
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Corissa Koopmans, '@corissalea'
Date: 2022-07-18
ATT&CK techniques: T1548
Log source: azure/

Description:
Monitor and alert on conditional access changes.

Detection logic:
{
  "selection": {
    "properties.message": "Add conditional access policy"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-infrastructure
Sigma Detection Rule: Users Added to Global or Device Admin Roles
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Michael Epping, '@mepples21'
Date: 2022-06-28
ATT&CK techniques: T1078.004
Log source: azure/

Description:
Monitor and alert for users added to device admin roles.

Detection logic:
{
  "selection": {
    "Category": "RoleManagement",
    "OperationName|contains|all": [
      "Add",
      "member to role"
    ],
    "TargetResources|contains": [
      "7698a772-787b-4ac8-901f-60d6b08affd2",
      "62e90394-69f5-4237-9[PII_REDACTED]45e10"
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-devices#device-administrator-roles
Sigma Detection Rule: Windows LAPS Credential Dump From Entra ID
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: andrewdanis
Date: 2024-06-26
ATT&CK techniques: T1098.005
Log source: azure/

Description:
Detects when an account dumps the LAPS password from Entra ID.

Detection logic:
{
  "selection": {
    "category": "Device",
    "activityType|contains": "Recover device local administrator password",
    "additionalDetails.additionalInfo|contains": "Successfully recovered local credential by device id"
  },
  "condition": "selection"
}

References:
  - https://twitter.com/NathanMcNulty/status/[PII_REDACTED]68632263
  - https://www.cloudcoffee.ch/microsoft-365/configure-windows-laps-in-microsoft-intune/
  - https://techcommunity.microsoft.com/t5/microsoft-entra-blog/introducing-windows-local-administrator-password-solution-with/ba-p/1942487
Sigma Detection Rule: Added Owner To Application
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'
Date: 2022-06-02
ATT&CK techniques: T1552
Log source: azure/

Description:
Detects when a new owner is added to an application. This gives that account privileges to make modifications and configuration changes to the application.

Detection logic:
{
  "selection": {
    "properties.message": "Add owner to application"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#new-owner
Sigma Detection Rule: App Granted Privileged Delegated Or App Permissions
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow'
Date: 2022-07-28
ATT&CK techniques: T1098.003
Log source: azure/

Description:
Detects when administrator grants either application permissions (app roles) or highly privileged delegated permissions

Detection logic:
{
  "selection": {
    "properties.message": "Add app role assignment to service principal"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-granted-highly-privileged-permissions
Sigma Detection Rule: Privileged Account Creation
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H', Tim Shelton
Date: 2022-08-11
ATT&CK techniques: T1078.004
Log source: azure/

Description:
Detects when a new admin is created.

Detection logic:
{
  "selection": {
    "properties.message|contains|all": [
      "Add user",
      "Add member to role"
    ],
    "Status": "Success"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts#changes-to-privileged-accounts
Sigma Detection Rule: Delegated Permissions Granted For All Users
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow'
Date: 2022-07-28
ATT&CK techniques: T1528
Log source: azure/

Description:
Detects when highly privileged delegated permissions are granted on behalf of all users

Detection logic:
{
  "selection": {
    "properties.message": "Add delegated permission grant"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-granted-highly-privileged-permissions
Sigma Detection Rule: CA Policy Updated by Non Approved Actor
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Corissa Koopmans, '@corissalea'
Date: 2022-07-19
ATT&CK techniques: T1548, T1556
Log source: azure/

Description:
Monitor and alert on conditional access changes. Is Initiated by (actor) approved to make changes? Review Modified Properties and compare "old" vs "new" value.

Detection logic:
{
  "selection": {
    "properties.message": "Update conditional access policy"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-infrastructure#conditional-access
Sigma Detection Rule: Changes to Device Registration Policy
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Michael Epping, '@mepples21'
Date: 2022-06-28
ATT&CK techniques: T1484
Log source: azure/

Description:
Monitor and alert for changes to the device registration policy.

Detection logic:
{
  "selection": {
    "Category": "Policy",
    "ActivityDisplayName": "Set device registration policies"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-devices#device-registrations-and-joins-outside-policy
Sigma Detection Rule: PIM Alert Setting Changes To Disabled
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H'
Date: 2022-08-09
ATT&CK techniques: T1078
Log source: azure/

Description:
Detects when PIM alerts are set to disabled.

Detection logic:
{
  "selection": {
    "properties.message": "Disable PIM Alert"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-identity-management#azure-ad-roles-assignment
Sigma Detection Rule: User Added To Group With CA Policy Modification Access
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Mark Morowczynski '@markmorow', Thomas Detzner '@tdetzner'
Date: 2022-08-04
ATT&CK techniques: T1548, T1556
Log source: azure/

Description:
Monitor and alert on group membership additions of groups that have CA policy modification access

Detection logic:
{
  "selection": {
    "properties.message": "Add member from group"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-infrastructure#conditional-access
Sigma Detection Rule: User Added To Privilege Role
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H'
Date: 2022-08-06
ATT&CK techniques: T1078.004
Log source: azure/

Description:
Detects when a user is added to a privileged role.

Detection logic:
{
  "selection": {
    "properties.message": [
      "Add eligible member (permanent)",
      "Add eligible member (eligible)"
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-identity-management#azure-ad-roles-assignment
Sigma Detection Rule: Azure Domain Federation Settings Modified
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer
Date: 2021-09-06
ATT&CK techniques: T1078
Log source: azure/

Description:
Identifies when an user or application modified the federation settings on the domain.

Detection logic:
{
  "selection": {
    "ActivityDisplayName": "Set federation settings on domain"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-monitor-federation-changes
Sigma Detection Rule: Application AppID Uri Configuration Changes
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'
Date: 2022-06-02
ATT&CK techniques: T1552, T1078.004
Log source: azure/

Description:
Detects when a configuration change is made to an applications AppID URI.

Detection logic:
{
  "selection": {
    "properties.message": [
      "Update Application",
      "Update Service principal"
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#appid-uri-added-modified-or-removed
Sigma Detection Rule: Too Many Global Admins
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
Date: 2023-09-14
ATT&CK techniques: T1078
Log source: azure/

Description:
Identifies an event where there are there are too many accounts assigned the Global Administrator role.

Detection logic:
{
  "selection": {
    "riskEventType": "tooManyGlobalAdminsAssignedToTenantAlertIncident"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-how-to-configure-security-alerts#there-are-too-many-global-administrators
Sigma Detection Rule: Roles Activation Doesn't Require MFA
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
Date: 2023-09-14
ATT&CK techniques: T1078
Log source: azure/

Description:
Identifies when a privilege role can be activated without performing mfa.

Detection logic:
{
  "selection": {
    "riskEventType": "noMfaOnRoleActivationAlertIncident"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-how-to-configure-security-alerts#roles-dont-require-multi-factor-authentication-for-activation
Sigma Detection Rule: Roles Are Not Being Used
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
Date: 2023-09-14
ATT&CK techniques: T1078
Log source: azure/

Description:
Identifies when a user has been assigned a privilege role and are not using that role.

Detection logic:
{
  "selection": {
    "riskEventType": "redundantAssignmentAlertIncident"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-how-to-configure-security-alerts#administrators-arent-using-their-privileged-roles