SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,500 copies16 likes159,696 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects when a user is added to a privileged role in Azure AD. This could indicate an attempt to escalate privileges or establish persistence within the cloud environment.
Identifies when the same privilege role has multiple activations by the same user, which could indicate an attempt to bypass time-based access restrictions or an adversary repeatedly activating a role for malicious purposes. This alert is triggered by the 'sequentialActivationRenewalsAlertIncident' risk event type in Azure PIM.
This rule identifies an event where the number of accounts assigned the Global Administrator role in Azure Active Directory (now Microsoft Entra ID) exceeds a predefined threshold. This is detected by monitoring the 'tooManyGlobalAdminsAssignedToTenantAlertIncident' risk event type from Azure PIM (Privileged Identity Management). A high number of Global Administrators can increase the attack surface and risk of privilege abuse or compromise.
Detects when user access has been blocked by Azure Conditional Access policies. This indicates that token issuance was denied, which could be a sign of unauthorized login attempts to valid accounts.
Detects when a user successfully logs on to sanctioned applications from an IP address identified as risky by Microsoft Cloud App Security. This indicates a potential compromise of the user's account or an attempt to access resources from an unusual and potentially malicious location.
Detects attempts to load images or drivers that violate Windows Code Integrity policies, indicating a potential bypass attempt or the execution of unsigned/malicious code. This event signifies that the system blocked the load due to unmet authenticode signing level requirements or a policy violation.
Detects logons using NTLM authentication, which can indicate the presence of legacy systems or be leveraged by attackers for lateral movement or credential access. Event ID 8002 specifically indicates an NTLM authentication event.
Detects when a security-enabled global group is deleted in a Windows environment. This activity can be indicative of an adversary attempting to remove traces of their presence or disrupt normal operations by deleting critical groups.
Detects the invocation of TabTip.exe via DCOM with a specific error ID, which is indicative of the JuicyPotatoNG tool being used in brute force mode for local privilege escalation. This technique leverages a DCOM vulnerability to elevate privileges.
Detects the execution of Scheduled Tasks where the program being run is located in a suspicious location or it's an unusual program to be run from a Scheduled Task. This rule specifically looks for Event ID 129 (Created Task Process) in the Task Scheduler Operational logs and checks if the executable path contains common temporary or user-download directories.
Page 225 of 680