SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,470 copies16 likes159,545 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Identifies when a new cloudshell is created inside of Azure portal.
Identifies when a suppression rule is created in Azure. Adversary's could attempt this to evade detection.
Identifies when a Virtual Network is modified or deleted in Azure.
Detects when highly privileged delegated permissions are granted on behalf of all users
Detects when a new owner is added to an application. This gives that account privileges to make modifications and configuration changes to the application.
Anonymous IP Address
Sigma
Indicates sign-ins from an anonymous IP address, for example, using an anonymous browser or VPN.
Indicates sign-in from a malicious IP address based on high failure rates.
Indicates sign-in from a malicious IP address known to be malicious at time of sign-in.
Indicates sign-ins from IP addresses infected with malware that is known to actively communicate with a bot server.
Account Lockout
Sigma
Identifies user account which has been locked because the user tried to sign in too many times with an incorrect user ID or password.
Page 625 of 680