SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,499 copies16 likes159,640 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects the usage of default credentials on assets by correlating vulnerability scan results from Qualys. Specifically, it looks for a predefined list of Qualys vulnerability IDs (QIDs) that indicate the presence of default credentials. The rule aims to identify systems that have not had their default passwords changed, which is a critical security hygiene practice.
Detects when a full data export is initiated in Bitbucket. This event indicates that a complete backup or export of all data within the Bitbucket instance has been triggered. This could be a legitimate administrative action but also a precursor to data exfiltration by an attacker who has gained administrative access to the Bitbucket server.
Detects when a new member is added or invited to a GitHub organization. This activity could indicate an attempt by an adversary to gain persistence within an organization's GitHub environment by adding a controlled account or inviting a malicious user.
This rule detects when a user disables critical security features within a GitHub organization or repository. This includes disabling advanced security features, OAuth app access restrictions, or two-factor authentication requirements. Such actions can significantly weaken the security posture of a GitHub environment, potentially leading to unauthorized access or compromise.
Detects when an organization member or an outside collaborator is added to or removed from a project board or has their permission level changed or when an owner removes an outside collaborator from an organization or when two-factor authentication is required in an organization and an outside collaborator does not use 2FA or disables 2FA.
Detects when a user creates a new secret within GitHub for an organization, environment, codespace, or repository. This activity is critical to monitor as secrets often contain sensitive credentials (e.g., API keys, tokens) that, if compromised or misused, can lead to unauthorized access, privilege escalation, or persistence within the GitHub environment. The rule specifically looks for audit log actions indicating the creation of these secrets.
Detects the creation of command-line interpreters (cmd.exe, powershell.exe) as child processes of Windows Server Update Services (WSUS) related process wsusservice.exe or w3wp.exe (WsusPool). This behavior is a key indicator of exploitation for critical remote code execution vulnerabilities such as CVE-2025-59287, where attackers spawn shells to conduct reconnaissance and further post-exploitation activities.
This rule detects the creation of an API token within the Okta environment. API tokens can be used for programmatic access to Okta resources, and their creation, especially if unauthorized or unexpected, could indicate an attempt to establish persistence or gain unauthorized access to the identity provider.
This rule detects the loading of known vulnerable drivers by their file names. Adversaries often leverage these vulnerable drivers to achieve privilege escalation or persistence on a system, typically by exploiting a known vulnerability in the driver to execute arbitrary code in kernel mode. The list of driver file names included in the detection logic corresponds to drivers identified as vulnerable, often used in 'Bring Your Own Vulnerable Driver' (BYOVD) attacks.
Detects the modification of a user group on a Fortinet FortiGate Firewall. This activity could be used by an attacker to grant themselves or other malicious accounts VPN access to a network, facilitating persistence or privilege escalation.
Page 178 of 680