SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,472 copies16 likes159,581 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Monitor and alert on conditional access changes. Is Initiated by (actor) approved to make changes? Review Modified Properties and compare "old" vs "new" value.
Monitor and alert on conditional access changes.
Detects when an account was created and deleted in a short period of time.
Monitor and alert for Bitlocker key retrieval.
Monitor and alert for changes to the device registration policy.
Monitor and alert for users added to device admin roles.
Detects when a configuration change is made to an applications AppID URI.
Detects when a configuration change is made to an applications URI.
URIs for domain names that no longer exist (dangling URIs), not using HTTPS, wildcards at the end of the domain, URIs that are no unique to that app, or URIs that point to domains you do not control should be investigated.
URIs for domain names that no longer exist (dangling URIs), not using HTTPS, wildcards at the end of the domain, URIs that are no unique to that app, or URIs that point to domains you do not control should be investigated.
Change to authentication method could be an indicator of an attacker adding an auth method to the account so they can have continued access.
Detects when a user that doesn't have permissions to invite a guest user attempts to invite one.
Page 80 of 680