SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,470 copies16 likes159,543 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects when a modification (create, update or replace) action is taken that affects mutating or validating webhook configurations, as they can be used by an adversary to achieve persistence or exfiltrate access credentials.
Detects instances where an SSH service on an OpenCanary node has had a login attempt.
Detects remote RPC calls to modify the registry and possible execute code
Detects the addition of a new network route to a route table in AWS.
Detects the import of SSH key pairs into AWS EC2, which may indicate an attacker attempting to gain unauthorized access to instances. This activity could lead to initial access, persistence, or privilege escalation, potentially compromising sensitive data and operations.
Detects a change in the AWS Identity Center (FKA AWS SSO) identity provider.
A change in identity provider allows an attacker to establish persistent access or escalate privileges via user impersonation.
A change in identity provider allows an attacker to establish persistent access or escalate privileges via user impersonation.
Identifies the suspicious use of GetSessionToken. Tokens could be created and used by attackers to move laterally and escalate privileges.
Identifies when an user or application modified the federation settings on the domain.
Monitor and alert on group membership removal of groups that have CA policy modification access
Detects when a PIM elevation is approved or denied. Outside of normal operations should be investigated.
Page 55 of 680