SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,500 copies16 likes159,687 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects when a user successfully resets their own password within Azure Active Directory. This rule specifically looks for 'UserManagement' category events with a 'Success' status, initiated by a 'UPN' (User Principal Name) and targeting a 'UPN' with an 'ActivityType' containing 'Password reset'.
Identifies when an account in a privileged role has not signed in for a specified number of days, indicating a potentially stale or unused privileged account. Such accounts can be a security risk if compromised, as they might not be actively monitored.
This rule detects sign-in attempts to Azure AD where the authentication requirement was single-factor, the sign-in was successful (ResultType: 0), the network location details were empty (indicating an unknown or unclassified location), and the device ID was also empty (indicating an unknown or unregistered device). This combination suggests a sign-in from an unknown device and potentially an untrusted location, which could be indicative of an adversary attempting to gain initial access or maintain persistence.
Detects failed attempts to sign in to disabled accounts within Azure Active Directory. This could indicate an attacker attempting to use compromised credentials for an account that has been deactivated, or an attempt to bypass security controls by targeting dormant accounts.
This rule detects unusual authentication interruptions in Azure Active Directory sign-in logs. Specifically, it looks for three types of ResultType and ResultDescription combinations: '50097 - Device authentication is required', '50155 - DeviceAuthenticationFailed', and '50158 - ExternalSecurityChallenge - External security challenge was not satisfied'. These events indicate that an authentication attempt was interrupted or failed due to device-related issues or an unmet external security challenge, which could be indicative of an adversary attempting to bypass authentication mechanisms or encountering unexpected security controls.
This rule detects successful user authentications from your Azure AD tenant to other Azure AD tenants. This activity can indicate an attacker attempting to maintain access or escalate privileges by leveraging existing user accounts to access resources in external tenants, or it could be a legitimate business-to-business (B2B) collaboration that needs to be approved.
Detects the command line executed when TeamViewer starts a session initiated by a remote host. An investigator can verify connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder.
Detects attempts to change the password of the Directory Services Restore Mode (DSRM) administrator account. This account is a local administrator account on Domain Controllers, and attackers may modify its password to establish persistence or elevate privileges.
Detects suspicious processes attempting to log on with explicit credentials (Event ID 4648). This rule specifically targets common command-line utilities like cmd.exe, powershell.exe, wmic.exe, net.exe, and reg.exe when they are used to explicitly log on, while filtering out localhost connections and service accounts (users ending with '$') to reduce false positives. This behavior can indicate an adversary attempting to escalate privileges or move laterally using compromised credentials.
Detects the creation of a Windows service named 'KrbSCM' which is associated with the KrbRelayUp tool. This tool is used for privilege escalation in Windows domain environments where LDAP signing is not enforced, leveraging Kerberos relay attacks.
Page 219 of 680