SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,499 copies16 likes159,641 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects when an Okta Policy Rule is either modified or deleted. Monitoring changes to policy rules is crucial as unauthorized modifications or deletions could indicate an attempt to bypass security controls, alter access permissions, or disrupt normal operations within the Okta environment. Such actions could lead to unauthorized access, privilege escalation, or impact the availability of services.
This rule detects failed user login attempts within Bitbucket. It specifically looks for audit events categorized as 'Authentication' with the action 'User login failed'. This type of event can indicate various activities, including legitimate users mistyping passwords, or malicious actors attempting to brute-force credentials or perform credential stuffing attacks against Bitbucket accounts.
This rule detects when Okta identifies new or unusual activity within the Admin Console. It specifically looks for 'policy.evaluate_sign_on' events targeting the 'Okta Admin Console' where Okta's internal heuristics (debugcontext.debugdata.behaviors or debugcontext.debugdata.logonlysecuritydata) flag the activity as 'POSITIVE' for unusual behavior. This can indicate an adversary attempting to gain or maintain access to administrative functions, or an administrator performing actions that are outside their typical patterns.
This rule detects when Okta FastPass successfully identifies and prevents an authentication attempt originating from a known phishing site. It specifically looks for Okta System Log events where the outcome reason is 'FastPass declined phishing attempt', the outcome result is 'FAILURE', and the event type is 'user.authentication.auth_via_mfa'. This indicates that a user attempted to authenticate via MFA, but Okta FastPass intervened due to a detected phishing attempt.
Detects when a global secret scanning rule is deleted in Bitbucket. This activity could indicate an adversary attempting to disable security controls to prevent detection of sensitive information exposure.
Detects when a secret scanning allowlist rule is added for projects in Bitbucket. This could indicate an attempt to bypass security controls by allowing certain secrets to be ignored by the scanning mechanism.
This rule detects when a secret scanning rule is deleted within Bitbucket for either a project or a repository. This action could indicate an attempt to bypass security controls by disabling mechanisms designed to detect sensitive information in code.
Detects when a GitHub repository or an organization is transferred to another location. This activity can indicate an attempt to exfiltrate sensitive data, establish persistence in a new location, or disrupt operations by moving critical assets. The rule specifically monitors GitHub audit logs for actions such as 'migration.create' (creation of a migration file for data transfer), 'org.transfer_outgoing' or 'org.transfer' (transfer of an organization between enterprise accounts), and 'repo.transfer_outgoing' (transfer of a repository to another network).
This rule detects when an application within the Okta environment is either modified or deleted. This activity can indicate administrative changes, potential misconfigurations, or malicious activity aimed at disrupting services or altering access controls.
Detects when the secret scanning feature is disabled for a GitHub enterprise or repository. This action can indicate an attempt to evade security monitoring and hide the introduction of sensitive information into codebases.
Page 181 of 680