azure Sigma detection rules

Detects when an account was created and deleted in a short period of time.

azure · auditlogs

Identifies that users were active from an IP address that has been identified as an anonymous proxy IP address.

azure · riskdetection

Detects when a new credential is added to an existing application. Any additional credentials added outside of expected processes could be a malicious actor using those credentials.

azure · auditlogs

Indicates that there are abnormal characteristics in the token such as an unusual token lifetime or a token that is played from an unfamiliar location.

azure · riskdetection

Indicates that there are anomalous patterns of behavior like suspicious changes to the directory.

azure · riskdetection

Indicates sign-ins from an anonymous IP address, for example, using an anonymous browser or VPN.

azure · riskdetection

Detects when an application is granted delegated or app role permissions for Microsoft Graph, Exchange, Sharepoint, or Azure AD

azure · auditlogs

Detects when administrator grants either application permissions (app roles) or highly privileged delegated permissions

azure · auditlogs

Detects when a configuration change is made to an applications AppID URI.

azure · auditlogs

Detects when a configuration change is made to an applications URI. URIs for domain names that no longer exist (dangling URIs), not using HTTPS, wildcards at the end of the domain, URIs that are no unique to that app, or URIs that point to domains you do not control should be investigated.

azure · auditlogs

Identifies two sign-ins originating from geographically distant locations, where at least one of the locations may also be atypical for the user, given past behavior.

azure · riskdetection

Indicates that the user's valid credentials have been leaked.

azure · riskdetection

Indicates user activity that is unusual for the user or consistent with known attack patterns.

azure · riskdetection

Detects when a user has been elevated to manage all Azure Subscriptions. This change should be investigated immediately if it isn't planned. This setting could allow an attacker access to Azure subscriptions in your environment.

azure · activitylogs

Detects when a user has been elevated to manage all Azure Subscriptions. This change should be investigated immediately if it isn't planned. This setting could allow an attacker access to Azure subscriptions in your environment.

azure · auditlogs

Detects when a user is removed from a privileged role. Bulk changes should be investigated.

azure · auditlogs

Monitor and alert for changes to the device registration policy.

azure · auditlogs

Detects when changes are made to PIM roles

azure · auditlogs

Detects when highly privileged delegated permissions are granted on behalf of all users

azure · auditlogs

Detects AzureHound (A BloodHound data collector for Microsoft Azure) activity via the default User-Agent that is used during its operation after successful authentication.

azure · signinlogs

Identifies user activities originating from geographically distant locations within a time period shorter than the time it takes to travel from the first location to the second.

azure · riskdetection

Identifies when an organization doesn't have the proper license for PIM and is out of compliance.

azure · pim

Indicates sign-in from a malicious IP address based on high failure rates.

azure · riskdetection

Indicates sign-in from a malicious IP address known to be malicious at time of sign-in.

azure · riskdetection

Detects sign-ins from new countries. The detection considers past activity locations to determine new and infrequent locations.

azure · riskdetection

Indicates that a password spray attack has been successfully performed.

azure · riskdetection

Detects when PIM alerts are set to disabled.

azure · auditlogs

Detects when a PIM elevation is approved or denied. Outside of normal operations should be investigated.

azure · auditlogs

Detects successful authentication from potential clients using legacy authentication via user agent strings. This could be a sign of MFA bypass using a password spray attack.

azure · signinlogs

Indicates access attempt to the PRT resource which can be used to move laterally into an organization or perform credential theft

azure · riskdetection

Detects failed sign-in due to user not meeting expected controls for adminitrators

azure · signinlogs

Identifies when the same privilege role has multiple activations by the same user.

azure · pim

Identifies when a privilege role can be activated without performing mfa.

azure · pim

Identifies when a user has been assigned a privilege role and are not using that role.

azure · pim

Identifies when a privilege role assignment has taken place outside of PIM and may indicate an attack.

azure · pim

Indicates the SAML token issuer for the associated SAML token is potentially compromised. The claims included in the token are unusual or match known attacker patterns

azure · riskdetection

Define a baseline threshold for failed sign-ins due to Conditional Access failures

azure · signinlogs

Indicates sign-ins from IP addresses infected with malware that is known to actively communicate with a bot server.

azure · riskdetection

Monitor and alert for sign-ins where the device was non-compliant.

azure · signinlogs

Identifies when an account hasn't signed in during the past n number of days.

azure · pim

Indicates anomalous behavior based on suspicious sign-in activity across multiple tenants from different countries in the same browser

azure · riskdetection

Indicates suspicious rules such as an inbox rule that forwards a copy of all emails to an external address

azure · riskdetection

Detects suspicious rules that delete or move messages or folders are set on a user's inbox.

azure · riskdetection

Detects risky authentication from a non AD registered device without MFA being required.

azure · signinlogs

Detects when a temporary access pass (TAP) is added to an account. TAPs added to priv accounts should be investigated

azure · auditlogs

Identifies an event where there are there are too many accounts assigned the Global Administrator role.

azure · pim

Detects sign-in with properties that are unfamiliar to the user. The detection considers past sign-in history to look for anomalous sign-ins.

azure · riskdetection

Alert on when legacy authentication has been used on an account

azure · signinlogs

Detects when a user is added to a privileged role.

azure · auditlogs

Detects changes and updates to the user risk and MFA registration policy. Attackers can modified the policies to Bypass MFA, weaken security thresholds, facilitate further attacks, maintain persistence.

azure · auditlogs

Monitor and alert for users added to device admin roles.

azure · auditlogs

Detects when an account dumps the LAPS password from Entra ID.

azure · auditlogs

Detects accounts that are created or deleted by non-approved users.

azure · auditlogs

Detects when an account is disabled or blocked for sign in but tried to log in

azure · signinlogs

Identifies user account which has been locked because the user tried to sign in too many times with an incorrect user ID or password.

azure · signinlogs

Detects when a new owner is added to an application. This gives that account privileges to make modifications and configuration changes to the application.

azure · auditlogs

Detects when an app is assigned Azure AD roles, such as global administrator, or Azure RBAC roles, such as subscription owner.

azure · auditlogs

Device code flow is an OAuth 2.0 protocol flow specifically for input constrained devices and is not used in all environments. If this type of flow is seen in the environment and not being used in an input constrained device scenario, further investigation is warranted. This can be a misconfigured application or potentially something malicious.

azure · signinlogs

Resource owner password credentials (ROPC) should be avoided if at all possible as this requires the user to expose their current password credentials to the application directly. The application then uses those credentials to authenticate the user against the identity provider.

azure · signinlogs

Detect when authentications to important application(s) only required single-factor authentication

azure · signinlogs

This detection uses azureactivity logs (Administrative category) to identify the creation or update of a server instance in an Azure AD Hybrid health AD FS service. A threat actor can create a new AD Health ADFS service and create a fake server instance to spoof AD FS signing logs. There is no need to compromise an on-prem AD FS server. This can be done programmatically via HTTP requests to Azure.

azure · activitylogs

This detection uses azureactivity logs (Administrative category) to identify the deletion of an Azure AD Hybrid health AD FS service instance in a tenant. A threat actor can create a new AD Health ADFS service and create a fake server to spoof AD FS signing logs. The health AD FS service can then be deleted after it is not longer needed via HTTP requests to Azure.

azure · activitylogs

Identifies when a application is deleted in Azure.

azure · auditlogs

Identifies when a application gateway is modified or deleted.

azure · activitylogs

Identifies when a application security group is modified or deleted.

azure · activitylogs

Identifies when a device in azure is no longer managed or compliant

azure · auditlogs

Identifies when a device or device configuration in azure is modified or deleted.

azure · activitylogs

Identifies when DNS zone is modified or deleted.

azure · activitylogs

Identifies when an user or application modified the federation settings on the domain.

azure · auditlogs

Identifies when a firewall is created, modified, or deleted.

azure · activitylogs

Identifies when Rule Collections (Application, NAT, and Network) is being modified or deleted.

azure · activitylogs

Identifies when a Firewall Rule Configuration is Modified or Deleted.

azure · activitylogs

Identifies when a key vault is modified or deleted.

azure · activitylogs

Identifies when a Keyvault Key is modified or deleted in Azure.

azure · activitylogs

Identifies when secrets are modified or deleted in Azure.

azure · activitylogs

Identifies when an admission controller is executed in Azure Kubernetes. A Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server. The behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster. An adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster. For example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod. An adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials. An adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information.

azure · activitylogs

Identifies when a Azure Kubernetes CronJob runs in Azure Cloud. Kubernetes Job is a controller that creates one or more pods and ensures that a specified number of them successfully terminate. Kubernetes Job can be used to run containers that perform finite tasks for batch jobs. Kubernetes CronJob is used to schedule Jobs. An Adversary may use Kubernetes CronJob for scheduling execution of malicious code that would run as a container in the cluster.

azure · activitylogs

Detects when Events are deleted in Azure Kubernetes. An adversary may delete events in Azure Kubernetes in an attempt to evade detection.

azure · activitylogs

Identifies when a Azure Kubernetes network policy is modified or deleted.

azure · activitylogs

Identifies the deletion of Azure Kubernetes Pods.

azure · activitylogs

Detects the creation or patching of potential malicious RoleBinding/ClusterRoleBinding.

azure · activitylogs

Identifies when a Kubernetes account access a sensitive objects such as configmaps or secrets.

azure · activitylogs

Identifies when ClusterRoles/Roles are being modified or deleted.

azure · activitylogs

Identifies when a service account is modified or deleted.

azure · activitylogs

Identifies when a Firewall Policy is Modified or Deleted.

azure · activitylogs

Identifies when a network security configuration is modified or deleted.

azure · activitylogs

Identifies when a new cloudshell is created inside of Azure portal.

azure · activitylogs

Identifies when a owner is was removed from a application or service principal in Azure.

azure · auditlogs

Identifies when a Point-to-site VPN is Modified or Deleted.

azure · activitylogs

Identifies when a service principal is created in Azure.

azure · auditlogs

Identifies when a service principal was removed in Azure.

azure · auditlogs

Identifies when a suppression rule is created in Azure. Adversary's could attempt this to evade detection.

azure · activitylogs

Detects when there is a interruption in the authentication process.

azure · signinlogs

Identifies when a virtual network device is being modified or deleted. This can be a network interface, network virtual appliance, virtual hub, or virtual router.

azure · activitylogs

Identifies when a Virtual Network is modified or deleted in Azure.

azure · activitylogs

Identifies when a VPN connection is modified or deleted.

azure · activitylogs

Monitor and alert for Bitlocker key retrieval.

azure · auditlogs

Monitor and alert on conditional access changes where non approved actor removed CA Policy.

azure · auditlogs

Monitor and alert on conditional access changes. Is Initiated by (actor) approved to make changes? Review Modified Properties and compare "old" vs "new" value.

azure · auditlogs

Detects when certificate based authentication has been enabled in an Azure Active Directory tenant.

azure · auditlogs

Change to authentication method could be an indicator of an attacker adding an auth method to the account so they can have continued access.

azure · auditlogs

Monitor and alert for device registration or join events where MFA was not performed.

azure · signinlogs

Detection for when multi factor authentication has been disabled, which might indicate a malicious activity to bypass authentication mechanisms.

azure · auditlogs

Detects when end user consent is blocked due to risk-based consent.

azure · auditlogs

Identifies IPs from which users grant access to other users on azure resources and alerts when a previously unseen source IP address is used.

azure · activitylogs

Detects when a user that doesn't have permissions to invite a guest user attempts to invite one.

azure · auditlogs

Detects guest users being invited to tenant by non-approved inviters

azure · auditlogs

Detect failed attempts to sign in to disabled accounts.

azure · signinlogs

Detects changes to the "StrongAuthenticationRequirement" value, where the state is set to "0" or "Disabled". Threat actors were seen disabling multi factor authentication for users in order to maintain or achieve access to the account. Also see in SIM Swap attacks.

azure · auditlogs

User has indicated they haven't instigated the MFA prompt and could indicate an attacker has the password for the account.

azure · signinlogs

Identifies user login with multifactor authentication failures, which might be an indication an attacker has the password for the account but can't pass the MFA challenge.

azure · signinlogs

Monitor and alert on conditional access changes.

azure · auditlogs

Detects newly added root certificate authority to an AzureAD tenant to support certificate based authentication.

azure · auditlogs

Number of VM creations or deployment activities occur in Azure via the azureactivity log.

azure · activitylogs

Detect when a user has reset their password in Azure AD

azure · auditlogs

Detects when a new admin is created.

azure · auditlogs

Identifies IPs from which users grant access to other users on azure resources and alerts when a previously unseen source IP address is used.

azure · activitylogs

Detect successful authentications from countries you do not operate out of.

azure · signinlogs

Detect access has been blocked by Conditional Access policies. The access policy does not allow token issuance which might be sights≈ of unauthorizeed login to valid accounts.

azure · signinlogs

User Added to an Administrator's Azure AD Role

azure · auditlogs

Monitor and alert on group membership additions of groups that have CA policy modification access

azure · auditlogs

Monitor and alert on group membership removal of groups that have CA policy modification access

azure · auditlogs

Detects the change of user type from "Guest" to "Member" for potential elevation of privilege.

azure · auditlogs

Detect when users in your Azure AD tenant are authenticating to other Azure AD Tenants.

azure · signinlogs

Detect when users are authenticating without MFA being required.

azure · signinlogs

Detects when a Container Registry is created or deleted.

azure · activitylogs

Detects when a Azure Kubernetes Cluster is created or deleted.

azure · activitylogs

Detects sign-in attempts in Azure/Entra ID logs where the user agent contains "axios", indicating potential use of automated credential harvesting or AiTM phishing infrastructure. Axios is a Node.js HTTP client abused to intercept and replay stolen credentials and MFA tokens. When triaging results, analysts should: - Check the sign-in risk level, MFA status, and conditional access results for signs of bypass. - Look for sign-ins from unusual locations or IPs, especially if the same IP targets multiple accounts. - Prioritize successful sign-ins over failed ones, as they may indicate a completed credential replay or AiTM attack.

azure · signinlogs

Detects when an end user consents to an application

azure · auditlogs

Detect failed authentications from countries you do not operate out of.

azure · signinlogs

Monitor and alert for Sign-ins by unknown devices from non-Trusted locations.

azure · signinlogs