SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,470 copies16 likes159,532 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects changes to the AppInstaller (winget) policy. Specifically the activation of the local manifest installation, which allows a user to install new packages via custom manifests.
Detects when an a role is modified or deleted in Google Workspace.
Detects Bitbucket global secret scanning rule deletion activity.
Detects when a user disables a critical security feature for an organization.
Detects when events are deleted in Kubernetes.
An adversary may delete Kubernetes events in an attempt to evade detection.
An adversary may delete Kubernetes events in an attempt to evade detection.
Detects that network ACL entries have been added to a route table which could indicate that new attack vectors have been opened up in the AWS account.
AWS Root Credentials
Sigma
Detects AWS root account usage
Detects when Events are deleted in Azure Kubernetes. An adversary may delete events in Azure Kubernetes in an attempt to evade detection.
Detects when certificate based authentication has been enabled in an Azure Active Directory tenant.
Detects newly added root certificate authority to an AzureAD tenant to support certificate based authentication.
Page 34 of 680