SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,472 copies16 likes159,587 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Indicates that a password spray attack has been successfully performed.
Detects when a Microsoft Cloud App Security reported for users whose account were terminated in Azure AD, but still perform activities in other platforms such as AWS or Salesforce.
This is especially relevant for users who use another account to manage resources, since these accounts are often not terminated when a user leaves the company.
This is especially relevant for users who use another account to manage resources, since these accounts are often not terminated when a user leaves the company.
Detects execution of GfxDownloadWrapper.exe with a URL as an argument to download file.
Detects Access to Domain Group Policies stored in SYSVOL
Detects a process spawned by the terminal service server process (this could be an indicator for an exploitation of CVE-2019-0708)
Detects potential OGNL Injection exploitation, which may lead to RCE.
OGNL is an expression language that is supported in many JVM based systems.
OGNL Injection is the reason for some high profile RCE's such as Apache Struts (CVE-2017-5638) and Confluence (CVE-2022-26134)
OGNL is an expression language that is supported in many JVM based systems.
OGNL Injection is the reason for some high profile RCE's such as Apache Struts (CVE-2017-5638) and Confluence (CVE-2022-26134)
Detects process execution related errors in NodeJS. If the exceptions are caused due to user input then they may suggest an RCE vulnerability.
Identifies disabling of default Amazon Elastic Block Store (EBS) encryption in the current region.
Disabling default encryption does not change the encryption status of your existing volumes.
Disabling default encryption does not change the encryption status of your existing volumes.
An attempt to export an AWS EC2 instance has been detected. A VM Export might indicate an attempt to extract information from an instance.
Detects the modification of an EC2 snapshot's permissions to enable access from another account
Page 596 of 680