SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,472 copies16 likes159,581 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the addition of a new Federated Domain.
Detects when a Microsoft Cloud App Security reported when a user signs into your sanctioned apps from a risky IP address.
Detects when a successful MFA authentication occurs due to the use of a bypass code.
A bypass code is a temporary passcode created by an administrator for a specific user to access a Duo-protected application. These are generally used as "backup codes," so that enrolled users who are having problems with their mobile devices (e.g., mobile service is disrupted, the device is lost or stolen, etc.) or who temporarily can't use their enrolled devices (on a plane without mobile data services) can still access their Duo-protected systems.
A bypass code is a temporary passcode created by an administrator for a specific user to access a Duo-protected application. These are generally used as "backup codes," so that enrolled users who are having problems with their mobile devices (e.g., mobile service is disrupted, the device is lost or stolen, etc.) or who temporarily can't use their enrolled devices (on a plane without mobile data services) can still access their Duo-protected systems.
Detects when an attempt at deactivating or resetting MFA.
Adversaries may use binary padding to add junk data and change the on-disk representation of malware.
This rule detect using dd and truncate to add a junk data to file.
This rule detect using dd and truncate to add a junk data to file.
Detects attempts to discover the files with setuid/setgid capability on them. That would allow adversary to escalate their privileges.
Detects removing immutable file attribute.
Masquerading occurs when the name or location of an executable, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation.
Several different variations of this technique have been observed.
Several different variations of this technique have been observed.
Detects embedding of files with usage of steghide binary, the adversaries may use this technique to prevent the detection of hidden information.
Detects extraction of files with usage of steghide binary, the adversaries may use this technique to prevent the detection of hidden information.
Page 84 of 680