SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,500 copies16 likes159,696 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
This rule detects various suspicious exceptions within Django web applications. These exceptions, such as 'SuspiciousOperation' and its subclasses (e.g., 'DisallowedHost', 'InvalidSessionKey', 'RequestDataTooBig'), as well as 'PermissionDenied', often indicate attempts to exploit vulnerabilities, bypass security controls, or engage in other malicious activities against the web application. Monitoring these exceptions can help identify potential attacks like web parameter tampering, session hijacking attempts, or unauthorized access attempts.
This rule detects potential local file read vulnerabilities in JVM-based applications by looking for specific keywords in application error logs. It triggers when a 'FileNotFoundException' occurs in conjunction with path traversal payloads like '/../../..'. This combination suggests an attacker is attempting to read arbitrary files from the system by manipulating input paths, which could lead to sensitive information disclosure.
Detects potential XML External Entity (XXE) exploitation attempts in JVM-based applications by looking for specific XML parsing error keywords in application error logs. These errors, such as 'SAXParseException' and 'DOMException', can indicate that an attacker is trying to manipulate XML input to access local files, perform server-side request forgery (SSRF), or execute other malicious actions. The rule is designed to identify issues where an application expects to work with XML and the parser might not be initialized safely.
This rule identifies when an Azure DNS zone is either modified or deleted. This activity is detected by monitoring Azure Activity Logs for operations starting with 'MICROSOFT.NETWORK/DNSZONES' and ending with '/WRITE' (for modifications) or '/DELETE' (for deletions). Such changes can indicate malicious activity aimed at redirecting traffic or disrupting services.
Detects when events are deleted in Azure Kubernetes. An adversary may delete events in Azure Kubernetes in an attempt to evade detection by removing forensic evidence.
Identifies when an Azure Firewall Rule Configuration is modified or deleted. This activity can indicate an adversary attempting to bypass network defenses or disrupt services.
Identifies when a service principal is created in Azure. This activity can be an indicator of an adversary establishing persistence or preparing for further actions within the Azure environment.
This rule identifies when Kubernetes secrets are modified or deleted within a Google Cloud Platform (GCP) environment. It specifically looks for audit log entries related to the creation, update, patch, or deletion of Kubernetes secrets.
Detects when a firewall rule is modified, deleted, or inserted in Google Cloud Platform (GCP). This activity can indicate an adversary attempting to impair defenses or establish persistence by altering network access controls.
Detects when Microsoft Cloud App Security identifies a user or IP address using an unsanctioned application to perform activities resembling data exfiltration from the organization. This rule specifically triggers on 'Data exfiltration to unsanctioned apps' events with a 'success' status from the SecurityComplianceCenter event source.
Page 464 of 680