SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,499 copies16 likes159,641 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects when an organization owner disables Dependabot alerts for private repositories or Dependabot security updates for all repositories within GitHub. Dependabot performs scans to detect insecure dependencies and sends alerts, so disabling these features can increase an organization's exposure to vulnerabilities.
Detects delete actions within GitHub audit logs related to codespaces, environments, projects, and repositories. This can indicate an attempt to remove critical development infrastructure or source code.
This rule detects changes to self-hosted GitHub Actions runner configurations. These changes include actions such as removing a self-hosted runner from an organization or repository, creating or removing runner groups, and adding, removing, or updating runners within a runner group. Such modifications can indicate administrative actions related to CI/CD infrastructure, which should be validated for legitimacy.
Detects when the global SSH access configuration is changed within Bitbucket. This could indicate an attempt to enable or modify SSH access for malicious purposes, potentially for lateral movement or persistence.
This rule detects when a repository within Bitbucket is configured to be exempt from secret scanning. This action could indicate an attempt to bypass security controls and hide sensitive information or malicious code within the repository without detection.
Detects when a user bypasses the push protection on a secret detected by secret scanning in GitHub. This indicates an attempt to commit code containing sensitive information despite automated safeguards.
Detects when a GitHub repository is archived or unarchived, which may indicate unauthorized changes to repository status. This action can be used by adversaries for various purposes, including defense evasion by hiding malicious repositories, persistence by making a repository less likely to be deleted, or impact by disrupting access to legitimate codebases.
Detects the addition of a new firewall policy on a Fortinet FortiGate Firewall. This activity could indicate an adversary attempting to alter network access controls for defense evasion, persistence, or to facilitate further malicious activity.
This rule detects hosts that are identified by a Qualys vulnerability scan as not having a firewall product detected. This indicates a compliance issue where a host is not protected by a firewall, potentially exposing it to unauthorized access or attacks. The alert signifies non-compliance with security policies.
Detects changes to the Bitbucket audit log configuration. This could indicate an adversary attempting to disable or modify logging to evade detection.
Page 180 of 680