SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,470 copies16 likes159,543 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects potential Kubernetes enumeration or attack activity via the audit log.
This includes the execution of common shells, utilities, or specialized tools like 'Rakkess' (access_matrix) and 'TruffleHog' via Kubernetes API requests.
Attackers use these methods to perform reconnaissance (enumeration), secret harvesting, or execute code (exec) within a cluster.
This includes the execution of common shells, utilities, or specialized tools like 'Rakkess' (access_matrix) and 'TruffleHog' via Kubernetes API requests.
Attackers use these methods to perform reconnaissance (enumeration), secret harvesting, or execute code (exec) within a cluster.
Detects the creation of a new office macro files on the systems
Detects modification of Windows Registry Classes keys used for persistence.
Adversaries modify these autostart extensibility points (ASEP) to execute malicious code when file types are opened or actions are performed.
Various legitimate software also uses these keys. Currently, this rule only filters out known legitimate software paths,
thus it is recommended to review and tune filters for your environment to reduce false positives before deploying to production.
Adversaries modify these autostart extensibility points (ASEP) to execute malicious code when file types are opened or actions are performed.
Various legitimate software also uses these keys. Currently, this rule only filters out known legitimate software paths,
thus it is recommended to review and tune filters for your environment to reduce false positives before deploying to production.
Detects when an application is modified or deleted.
Detects when an Okta end-user reports activity by their account as being potentially suspicious.
Detects Bitbucket global SSH access configuration changes.
Detects changes to the bitbucket audit log configuration.
Detects when a secret scanning allowlist rule is added for projects.
Detects when a repository is exempted from secret scanning feature.
Detects when a user creates action secret for the organization, environment, codespaces or repository.
Page 54 of 680