SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,499 copies16 likes159,666 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects changes to the ClickOnce trust prompt registry key to enable installations from various locations, such as the Internet. This modification can allow an attacker to bypass security prompts and execute untrusted code via ClickOnce applications.
Detects activity when an AWS user's login profile (password) is modified by another user. This can indicate an attacker with the "iam:UpdateLoginProfile" permission is changing passwords on behalf of other users to gain access to the AWS console.
This rule detects when a Conditional Access (CA) policy is deleted in Azure Active Directory (now Microsoft Entra ID). This activity is critical to monitor as the removal of a CA policy can significantly weaken an organization's security posture by bypassing multi-factor authentication, device compliance checks, or other access controls. The rule specifically looks for the 'Delete conditional access policy' message in the Azure Audit Logs. While the rule's title suggests identifying actions by 'non-approved actors', the current detection logic only identifies the deletion event itself, not the actor's approval status. Further enrichment or correlation would be needed to determine if the actor is unauthorized.
This rule detects when a user is removed from a group that has Conditional Access (CA) policy modification access within Azure Active Directory. Such groups are critical for managing access to resources, and unauthorized removal of members could indicate an attempt to evade detection, disrupt security controls, or prepare for further malicious activity. Monitoring these removals helps identify potential privilege escalation, defense evasion, or persistence attempts.
This rule detects a measurable increase of successful authentications, specifically when the count of successful sign-ins increases by 10% or greater. This could indicate an adversary attempting to gain access through brute-force, password spraying, or credential stuffing attacks, or potentially an increase in legitimate user activity that needs to be baselined.
Detects attempts to discover files with setuid/setgid capabilities using the 'getcap' command. This activity is often a precursor to privilege escalation on Linux systems, as adversaries search for binaries that can be abused to gain higher privileges.
This rule detects the creation of new files within the `/etc/sudoers.d/` directory. Files in this directory can be used to grant specific users or groups elevated privileges without requiring a password, serving as a persistence mechanism for attackers to maintain privileged access.
This rule detects attempts to add a user to the 'admin' group on macOS systems using the `dscl` command-line utility. Specifically, it looks for `dscl` commands that include the `-append` option, target the `/Groups/admin` path, and modify `GroupMembership`. This activity is often associated with privilege escalation or persistence by granting administrative rights to a standard user account.
This rule detects suspicious DCE-RPC function calls that indicate remote execution techniques on a Windows system. It specifically looks for operations related to scheduled tasks (JobAdd, SchRpcEnableTask, SchRpcRegisterTask, SchRpcRun), WMI execution (ExecMethod, ExecMethodAsync), and service creation/start (CreateServiceA/W, StartServiceA/W). These activities are commonly abused by adversaries for initial access, persistence, and lateral movement.
Detects successful logon from public IP address via SMB. This can indicate a publicly-exposed SMB port.
Page 200 of 680