SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,472 copies16 likes159,579 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
New Country
Sigma
Detects sign-ins from new countries. The detection considers past activity locations to determine new and infrequent locations.
Indicates anomalous behavior based on suspicious sign-in activity across multiple tenants from different countries in the same browser
Indicates user activity that is unusual for the user or consistent with known attack patterns.
Identifies when an account hasn't signed in during the past n number of days.
Invalid PIM License
Sigma
Identifies when an organization doesn't have the proper license for PIM and is out of compliance.
Identifies when a privilege role assignment has taken place outside of PIM and may indicate an attack.
Identifies when the same privilege role has multiple activations by the same user.
Identifies when a privilege role can be activated without performing mfa.
Identifies when a user has been assigned a privilege role and are not using that role.
Monitor and alert for device registration or join events where MFA was not performed.
Page 82 of 680