SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,472 copies16 likes159,579 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects risky authentication from a non AD registered device without MFA being required.
Monitor and alert for sign-ins where the device was non-compliant.
Monitor and alert for Sign-ins by unknown devices from non-Trusted locations.
Device code flow is an OAuth 2.0 protocol flow specifically for input constrained devices and is not used in all environments.
If this type of flow is seen in the environment and not being used in an input constrained device scenario, further investigation is warranted.
This can be a misconfigured application or potentially something malicious.
If this type of flow is seen in the environment and not being used in an input constrained device scenario, further investigation is warranted.
This can be a misconfigured application or potentially something malicious.
Detects when an account is disabled or blocked for sign in but tried to log in
Alert on when legacy authentication has been used on an account
User has indicated they haven't instigated the MFA prompt and could indicate an attacker has the password for the account.
Detects when there is a interruption in the authentication process.
Detects a successful login to the Microsoft Intune Company Portal which could allow bypassing Conditional Access Policies and InTune device trust using a tool like TokenSmith.
Detects disabling of Multi Factor Authentication.
Page 83 of 680