SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,499 copies16 likes159,644 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects when an Okta Network Zone is deactivated or deleted. This activity can indicate an attempt to bypass network-based security controls, potentially allowing unauthorized access from untrusted IP ranges or locations. It could be a precursor to other malicious activities or an attempt to hinder forensic investigation.
Detects when a user attempts to access an application in Okta without proper authorization. This could indicate an attacker trying to gain unauthorized access to resources or a legitimate user attempting to access an application they do not have permissions for.
Detects when an Okta user session starts from an IP address associated with an anonymizing proxy service. This could indicate an attempt to bypass security controls or obscure the true origin of the access.
Detects when a user account in Okta is locked out due to exceeding the maximum number of sign-in attempts. This can indicate brute-force attacks, password spraying, or legitimate users forgetting their passwords.
Detects the creation of new user accounts within Okta. This rule specifically looks for the 'user.lifecycle.create' event type in Okta logs, indicating that a new user account has been provisioned in the identity management system.
Detects when an Okta application Sign-on Policy is modified or deleted. This could indicate an adversary attempting to weaken security controls to gain unauthorized access or maintain persistence.
This rule detects when an end-user within an Okta environment reports suspicious activity associated with their account. This event indicates that a user has actively flagged an action or login as potentially unauthorized or malicious, prompting further investigation.
This rule detects when a user account in OneLogin is locked or suspended, either through the API or other system actions. This could indicate an attempt to disrupt user access or a response to suspicious activity.
Detects when a user has potentially entered their password into the username field during a failed Okta login attempt. This can lead to the password being retained in log files, posing a security risk.
Detects suspicious process creation activities executed by the SYSTEM user, specifically looking for known malicious programs or command-line parameters often associated with credential dumping, defense evasion, and privilege escalation techniques. This includes the use of tools like Mimikatz, Rubeus, ProcDump, and various PowerShell obfuscation methods, as well as commands related to shadow copy deletion and registry hive saving.
Page 183 of 680