SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,499 copies16 likes159,671 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Identifies when an ElastiCache security group has been modified or deleted.
Detects when an IP set is created in AWS GuardDuty. This activity could indicate an adversary attempting to whitelist their malicious IP addresses to avoid detection by GuardDuty, thereby disabling security alerts against their activities.
This rule detects when an application is granted delegated or app role permissions within Microsoft Graph, Exchange, SharePoint, or Azure AD. This activity can indicate an adversary attempting to establish persistence or elevate privileges by giving a malicious application access to sensitive resources.
This rule identifies user sign-ins originating from anonymous IP addresses, which may indicate the use of VPNs, Tor, or other anonymization services. Such activity can be a sign of an adversary attempting to mask their true location or identity during an access attempt.
This rule detects sign-in attempts originating from IP addresses that Microsoft Entra ID Protection has identified as malicious. These IP addresses are known to be associated with attackers or compromised systems at the time of the sign-in, indicating a high-risk authentication attempt.
This rule detects sign-in attempts originating from a country that is considered new or infrequent for the user based on their past activity locations. This behavior can indicate a compromised account being used by an attacker from an unusual geographic location.
Identifies when a service account is disabled or deleted in Google Cloud. This activity can indicate an attempt to remove access for legitimate services or users, potentially as part of an impact or defense evasion strategy.
Alert when a user has performed an export to a search using 'New-ComplianceSearchAction' with the '-Export' flag. This detection will detect PST export even if the 'eDiscovery search or exported' alert is disabled in the O365. This rule will apply to ExchangePowerShell usage and from the cloud.
Detects when the Microsoft 365 Security Compliance Center restricts a user from sending email because they exceeded service sending limits. This could indicate a compromised account being used for spamming or other malicious activities, or a legitimate user exceeding limits due to unusual activity.
Detects attempts to collect image data stored in the clipboard from users using the 'xclip' tool. This rule specifically looks for 'xclip' execution with parameters indicating selection from the clipboard for image data output. It is highly recommended for server environments due to frequent legitimate clipboard utility usage on user workstations.
Page 481 of 680