SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,506 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects enabling or disabling of Remote Desktop Protocol (RDP) using alternate methods such as WMIC or PowerShell.
In PowerShell one-liner commands, the "SetAllowTSConnections" method of the "Win32_TerminalServiceSetting" class may be used to enable or disable RDP.
In WMIC, the "rdtoggle" alias or "Win32_TerminalServiceSetting" class may be used for the same purpose.
In PowerShell one-liner commands, the "SetAllowTSConnections" method of the "Win32_TerminalServiceSetting" class may be used to enable or disable RDP.
In WMIC, the "rdtoggle" alias or "Win32_TerminalServiceSetting" class may be used for the same purpose.
Detects the occurrence of numerous space characters in TypedPaths registry paths, which may indicate execution via phishing lures using file-fix techniques to hide malicious commands. This technique is often used to bypass security controls that might inspect the command line for malicious strings.
Detects the creation of a new administrator account on a Fortinet FortiGate Firewall. This activity could indicate an attacker establishing persistence or escalating privileges within the network infrastructure.
This rule detects the usage of cleartext protocols for transmitting sensitive information, such as account usernames and authentication credentials, across networks. It specifically monitors Netflow data for connections to common ports associated with unencrypted services like HTTP, FTP, Telnet, and various database/application ports. The goal is to ensure that all sensitive data and administrative access utilize encrypted channels to prevent credential access and data interception.
Detects when a new administrator role assignment is created within Okta. This activity can indicate privilege escalation, where an attacker gains higher-level permissions, or persistence, where an attacker establishes a way to maintain access to the system over time.
This rule detects when GitHub's push protection feature is disabled. This feature helps prevent sensitive information, such as secrets, from being accidentally committed to repositories. Disabling it could indicate an attempt to bypass security controls, potentially allowing secrets to be exposed in code.
Detects when an administrator role is assigned to a user or group within Okta. This could indicate privilege escalation or persistence by an attacker, or a legitimate administrative action.
Detects the creation of a new local user on a Fortinet FortiGate Firewall. The new local user could be used for VPN connections.
Detects when a successful multi-factor authentication (MFA) occurs due to the use of a bypass code in Cisco Duo. Bypass codes are temporary passcodes created by administrators for specific users to access Duo-protected applications, typically used as backup codes when users cannot use their enrolled devices. This rule identifies instances where such a bypass code facilitates a successful authentication.
This rule detects the usage of default credentials on assets by correlating vulnerability scan results from Qualys. Specifically, it looks for a predefined list of Qualys vulnerability IDs (QIDs) that indicate the presence of default credentials. The rule aims to identify systems that have not had their default passwords changed, which is a critical security hygiene practice.
Page 176 of 680