SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,470 copies16 likes159,538 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects updates of the GuardDuty list of trusted IPs, perhaps to disable security alerts against malicious IPs.
Detects the modification of the findings on SecurityHub.
Identifies when suspicious SAML activity has occurred in AWS. An adversary could gain backdoor access via SAML.
Monitor and alert on group membership additions of groups that have CA policy modification access
Detects sign-in with properties that are unfamiliar to the user. The detection considers past sign-in history to look for anomalous sign-ins.
Identifies an event where there are there are too many accounts assigned the Global Administrator role.
Detect failed attempts to sign in to disabled accounts.
Detects a login attempt in Google Workspace flagged as a potential attack by a government-backed threat actor
Detects when Okta identifies new activity in the Admin Console.
Detect file time attribute change to hide new or changes to existing files.
Page 42 of 680