Every rule below is a real, production-shaped Sigma detection — MITRE ATT&CK mapped, schema-validated, and shipped with the reasoning behind it. Read them free. Verify the ones that hold up in your environment.
12
Curated detections
12
ATT&CK techniques
0
Community verifications
Reading is free. Multi-SIEM translation, full rule logic, and GitHub sync are Builder-tier features. Create a free account to claim one free translation, or Upgrade to Builder →
2026 — Suspicious OAuth consent to non-verified publisher (M365)
Detects a user granting Mail.Read or Files.Read.All consent to an application whose publisher is unverified — a common initial-access technique for illicit-consent phishing (aka OAuth phishing). No blanket exclusions are applied — the selectors are narrow enough to stand alone. Published at high severity; validate against your own log source and tune thresholds or timeframes before wiring it to paging.
title: 2026 — Suspicious OAuth consent to non-verified publisher (M365)
id: aeg-2026-010
status: production
description: Detects a user granting Mail.Read or Files.Read.All consent to an application whose publisher is unverified — a common initial-access technique for illicit-consent phishing (aka OAuth phishing).
author: Aegisyst
tags:
- attack.initial_access
- attack.t1566.002
logsource:
Detects wmic.exe or vssadmin.exe being used to delete Volume Shadow Copies — a near-universal step of Windows ransomware families (Akira, LockBit 5.0, Play) before the encryption stage. No blanket exclusions are applied — the selectors are narrow enough to stand alone. Published at critical severity; validate against your own log source and tune thresholds or timeframes before wiring it to paging.
title: 2026 — Ransomware precursor — Volume Shadow Copy deletion via wmic
id: aeg-2026-009
status: production
description: Detects wmic.exe or vssadmin.exe being used to delete Volume Shadow Copies — a near-universal step of Windows ransomware families (Akira, LockBit 5.0, Play) before the encryption stage.
author: Aegisyst
tags:
- attack.impact
- attack.t1490
logsource:
Detects a Kubernetes ServiceAccount token being used from an IP address outside the pod CIDR — indicates token theft and reuse from a compromised endpoint or CI runner. No blanket exclusions are applied — the selectors are narrow enough to stand alone. Published at high severity; validate against your own log source and tune thresholds or timeframes before wiring it to paging.
title: 2026 — Kubernetes serviceaccount token abuse
id: aeg-2026-008
status: production
description: Detects a Kubernetes ServiceAccount token being used from an IP address outside the pod CIDR — indicates token theft and reuse from a compromised endpoint or CI runner.
author: Aegisyst
tags:
- attack.credential_access
- attack.t1552.007
logsource:
Detects creation of an AWS Lambda function with an unusually large environment variable payload (>4KB) or a raw base64-encoded ZIP body. Threat actors use this to hide persistence payloads inside function metadata. No blanket exclusions are applied — the selectors are narrow enough to stand alone. Published at medium severity; validate against your own log source and tune thresholds or timeframes before wiring it to paging.
title: 2026 — Living-off-the-cloud lambda backdoor
id: aeg-2026-007
status: production
description: Detects creation of an AWS Lambda function with an unusually large environment variable payload (>4KB) or a raw base64-encoded ZIP body. Threat actors use this to hide persistence payloads inside function metadata.
author: Aegisyst
tags:
- attack.persistence
- attack.t1543
logsource:
Detects >5 failed Entra ID MFA challenge responses in 3 minutes for a single user — the signature of MFA fatigue / push-bombing attacks that led to the 2022 Uber breach and remains prevalent through 2025. No blanket exclusions are applied — the selectors are narrow enough to stand alone. Published at high severity; validate against your own log source and tune thresholds or timeframes before wiring it to paging.
title: 2026 — MFA fatigue push-bomb (Microsoft Entra)
id: aeg-2026-006
status: production
description: Detects >5 failed Entra ID MFA challenge responses in 3 minutes for a single user — the signature of MFA fatigue / push-bombing attacks that led to the 2022 Uber breach and remains prevalent through 2025.
author: Aegisyst
tags:
- attack.credential_access
- attack.t1621
logsource:
Detects Node.js processes executing postinstall lifecycle scripts that spawn network activity to non-registry hosts — the pattern used by the shai-hulud and pytorch-nightly supply-chain campaigns. No blanket exclusions are applied — the selectors are narrow enough to stand alone. Published at medium severity; validate against your own log source and tune thresholds or timeframes before wiring it to paging.
title: 2026 — Suspicious npm postinstall script (supply-chain)
id: aeg-2026-005
status: production
description: Detects Node.js processes executing postinstall lifecycle scripts that spawn network activity to non-registry hosts — the pattern used by the shai-hulud and pytorch-nightly supply-chain campaigns.
author: Aegisyst
tags:
- attack.execution
- attack.t1195.002
logsource:
2026 — AWS IAM privilege escalation via CreateAccessKey on foreign user
Detects an IAM principal creating a new access key for a different IAM user — a common privilege-persistence technique after initial compromise of a low-privilege role. No blanket exclusions are applied — the selectors are narrow enough to stand alone. Published at high severity; validate against your own log source and tune thresholds or timeframes before wiring it to paging.
title: 2026 — AWS IAM privilege escalation via CreateAccessKey on foreign user
id: aeg-2026-004
status: production
description: Detects an IAM principal creating a new access key for a different IAM user — a common privilege-persistence technique after initial compromise of a low-privilege role.
author: Aegisyst
tags:
- attack.persistence
- attack.t1098.001
logsource:
2026 — OneDrive/SharePoint mass-download by external user
Detects an external (non-tenant) user downloading >50 files from OneDrive or SharePoint within 10 minutes. Common precursor to data exfiltration via B2B guest access. No blanket exclusions are applied — the selectors are narrow enough to stand alone. Published at high severity; validate against your own log source and tune thresholds or timeframes before wiring it to paging.
title: 2026 — OneDrive/SharePoint mass-download by external user
id: aeg-2026-003
status: production
description: Detects an external (non-tenant) user downloading >50 files from OneDrive or SharePoint within 10 minutes. Common precursor to data exfiltration via B2B guest access.
author: Aegisyst
tags:
- attack.exfiltration
- attack.t1567.002
logsource:
2026 — Kerberoasting via Rubeus / Impacket GetUserSPNs
Detects Kerberos service-ticket requests using RC4 encryption from a single principal to many SPNs — the fingerprint of Kerberoasting toolkits (Rubeus, Impacket GetUserSPNs, Kerberoast.py). No blanket exclusions are applied — the selectors are narrow enough to stand alone. Published at high severity; validate against your own log source and tune thresholds or timeframes before wiring it to paging.
title: 2026 — Kerberoasting via Rubeus / Impacket GetUserSPNs
id: aeg-2026-002
status: production
description: Detects Kerberos service-ticket requests using RC4 encryption from a single principal to many SPNs — the fingerprint of Kerberoasting toolkits (Rubeus, Impacket GetUserSPNs, Kerberoast.py).
author: Aegisyst
tags:
- attack.credential_access
- attack.t1558.003
logsource:
2026 — LOLBAS execution via curl.exe (Windows) with suspicious URI
Detects living-off-the-land use of the Microsoft-signed curl.exe binary to download payloads from newly-registered or IP-only URIs, a technique heavily used by the Lazarus and FIN7 clusters through 2025. Known benign sources are excluded up front: Legitimate CI/CD runners downloading artifacts from private IP-based mirrors. Published at high severity; validate against your own log source and tune thresholds or timeframes before wiring it to paging.
title: 2026 — LOLBAS execution via curl.exe (Windows) with suspicious URI
id: aeg-2026-001
status: production
description: Detects living-off-the-land use of the Microsoft-signed curl.exe binary to download payloads from newly-registered or IP-only URIs, a technique heavily used by the Lazarus and FIN7 clusters through 2025.
author: Aegisyst
references:
- https://lolbas-project.github.io/lolbas/Binaries/Curl/
tags:
- attack.execution
[HIGH PRIORITY] Linux Kernel Unspecified Vulnerability
The rule targets the adversary chain where an unprivileged process triggers a Linux kernel IPv6 subsystem flaw (via raw socket manipulation, IPv6 setsockopt abuse, or crafted netlink/ping6 payloads) and then spawns a root shell or persistence command — matched by pairing parent process context (ip/ping6/setsockopt-invoking binaries or web/service daemons) with suspicious child CommandLine patterns such as `id`, `uid=0`, `/bin/sh -i`, `chmod +s`, or writes to `/etc/passwd`. Filters exclude standard OS parent processes (services.exe, svchost.exe, etc.) and routine update/AV tooling noise because those are Windows-native FP sources that should never legitimately match a Linux kernel exploit chain, while still allowing genuine cross-platform SIEM ingestion. Tune the `susp_parent` list to your Linux distro (add package managers like `apt`/`dnf` if legitimate admin scripts trigger FPs) and consider raising severity when the parent is a network-facing daemon such as `nginx`, `httpd`, or `sshd`.
title: Potential Linux Kernel IPv6 Privilege Escalation Exploitation (CVE-2026-53362)
detection_logic_description: 'The rule targets the adversary chain where an unprivileged process triggers a Linux kernel IPv6 subsystem flaw (via raw socket manipulation, IPv6 setsockopt abuse, or crafted netlink/ping6 payloads) and then spawns a root shell or persistence command — matched by pairing parent process context (ip/ping6/setsockopt-invoking binaries or web/service daemons) with suspicious child CommandLine patterns such as `id`, `uid=0`, `/bin/sh -i`, `chmod +s`, or writes to `/etc/passwd`. Filters exclude standard OS parent processes (services.exe, svchost.exe, etc.) and routine update/AV tooling noise because those are Windows-native FP sources that should never legitimately match a Linux kernel exploit chain, while still allowing genuine cross-platform SIEM ingestion. Tune the `susp_parent` list to your Linux distro (add package managers like `apt`/`dnf` if legitimate admin scripts trigger FPs) and consider raising severity when the parent is a network-facing daemon such as
`nginx`, `httpd`, or `sshd`.
'
id: 7c3a1e4d-9b2f-4a8e-b6c1-2e5f9a3d7b81
status: experimental
description: Detects suspicious privilege escalation chains associated with exploitation of the Linux Kernel IPv6 subsystem vulnerability CVE-2026-53362.
references:
Unsecured Credentials Access Via Common Discovery and Dump Locations (T1552)
Detects process events where utilities access known unsecured credential locations, patterns, or invoke credential-related commands (e.g., '.rdp', '.kdbx', credential stores). Ignores noise from OS-initiated processes and standard update activities, utilizing specific exclusions. To optimize, incorporate exclusions for authorized admin tools and adjust for sensitive extensions relevant to the organization.
title: Unsecured Credentials Access Via Common Discovery and Dump Locations (T1552)
id: 6ef7d2ef-197d-4f1c-8b33-50b3f8c7b0a9
status: experimental
description: Detects processes attempting to read common unsecured credential sources such as files containing passwords, Windows credential stores, and unattended installation artifacts. Maps to MITRE ATT&CK T1552 Unsecured Credentials.
author: ChatGPT (Detection Engineering)
date: 2026-08-16
references:
- https://attack.mitre.org/techniques/T1552/
logsource:
Multi-SIEM TranslateSync to GitHub107 lines · sigma
Ready to deploy these detections?
The Builder tier turns any rule in this library into Splunk SPL, Sentinel KQL, Elastic EQL or Wazuh XML — using your own field names — and commits it straight to your detection-as-code repo.