SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,499 copies16 likes159,644 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects when a new identity provider is created in Okta. This activity can be a legitimate administrative action but could also indicate an attacker attempting to establish persistence or bypass authentication mechanisms by creating a rogue identity provider.
Detects cast exceptions in Windows Server Update Services (WSUS) application logs that highly indicate exploitation attempts of CVE-2025-59287, a deserialization vulnerability in WSUS. The rule specifically looks for `System.InvalidCastException` and `System.Windows.Data.ObjectDataProvider` along with `Unable to cast object of type` and `System.Windows.Media.Brush` within EventID 7053 from the 'Windows Server Update Services' provider.
Detects the modification of VPN SSL Settings (for example, the modification of authentication rules).
This behavior was observed in pair with the addition of a VPN SSL Web Portal.
This behavior was observed in pair with the addition of a VPN SSL Web Portal.
Detects attempts to export user permission data from Bitbucket, which could indicate reconnaissance or data collection activities by an adversary.
Detects when a user in OneLogin assumes the identity of another user account. This could indicate an attacker using compromised credentials to impersonate another user or an insider abusing privileges.
This rule detects unauthorized access attempts to resources within Bitbucket. It specifically looks for audit events categorized under 'Security' with the action 'Unauthorized access to a resource'. This indicates that a user or system tried to access a Bitbucket resource without proper permissions.
Detects SSH user login access failures in Bitbucket. This rule can be noisy and is recommended to be used with correlation based on the "author.name" field to reduce false positives.
This rule detects attempts by an unauthorized user to trigger a full data export from Bitbucket. This activity could indicate an adversary attempting to collect sensitive information, such as source code or credentials, from the code repository.
This rule detects attempts to export user details from Bitbucket, including successful exports, failed attempts, and the initiation of such exports. This activity could indicate an adversary attempting to collect sensitive user information for further reconnaissance or data exfiltration.
This rule detects when a Multi-Factor Authentication (MFA) factor is deactivated or all MFA factors are reset for a user within Okta. This activity can indicate an adversary attempting to bypass or disable MFA to gain persistent access to an account.
Page 182 of 680