SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,499 copies16 likes159,641 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects when the policy allowing forks of private and internal repositories is changed (enabled or cleared) within a GitHub enterprise environment. This action can indicate an attempt to exfiltrate data by creating copies of sensitive repositories or a change in security posture.
Detects when changes are made to the SSH certificate configuration of a GitHub organization, specifically the creation of an SSH certificate authority or the disabling of the requirement for members to use SSH certificates.
Detects when an Okta policy is modified or deleted, which could indicate an attempt to alter security controls or bypass existing policies. This activity should be monitored closely as it can precede unauthorized access or other malicious actions.
Detects when a GitHub Pages site of a repository is made public. This action, while potentially part of a legitimate publishing process, could also indicate an adversary attempting to expose sensitive information or code publicly. Monitoring this activity helps identify potential unauthorized data exposure.
This rule detects when an API token is revoked within the Okta environment. API tokens are used for authentication and authorization to access Okta APIs. Revoking a token can be a normal administrative action, but it can also indicate an attempt to disable a compromised token or an adversary attempting to disrupt legitimate access.
This rule detects attempts to access Okta administrative functions when the request is routed through a proxy. This could indicate an adversary attempting to bypass security controls or obscure their origin when performing administrative actions within Okta.
Detects the addition of firewall address objects on a Fortinet FortiGate Firewall. This activity could indicate an adversary attempting to modify network access controls to facilitate command and control, data exfiltration, or to bypass existing security policies.
Detects when an Okta ThreatInsight security threat is detected. This indicates that Okta has identified suspicious activity, potentially from a malicious IP address, attempting to access an organization's Okta tenant.
Detects the addition of a new VPN SSL Web Portal on a Fortinet FortiGate Firewall. This activity can be an indicator of an adversary establishing persistence or initial access, especially when observed in conjunction with other modifications to VPN SSL settings. Attackers might add new web portals to maintain access to the network or to create new entry points.
This rule detects changes to global permissions within Bitbucket. This includes requests to grant or remove global permissions, as well as the successful granting or removal of such permissions. Monitoring these events is crucial for identifying unauthorized privilege escalation or persistence attempts within a Bitbucket instance.
Page 179 of 680