SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,510 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects when changes are made to the SSH certificate configuration of a GitHub organization, specifically the creation of an SSH certificate authority or the disabling of the requirement for members to use SSH certificates.
Detects when an Okta policy is modified or deleted, which could indicate an attempt to alter security controls or bypass existing policies. This activity should be monitored closely as it can precede unauthorized access or other malicious actions.
Detects the addition of firewall address objects on a Fortinet FortiGate Firewall. This activity could indicate an adversary attempting to modify network access controls to facilitate command and control, data exfiltration, or to bypass existing security policies.
Detects when a GitHub Pages site of a repository is made public. This action, while potentially part of a legitimate publishing process, could also indicate an adversary attempting to expose sensitive information or code publicly. Monitoring this activity helps identify potential unauthorized data exposure.
This rule detects when an API token is revoked within the Okta environment. API tokens are used for authentication and authorization to access Okta APIs. Revoking a token can be a normal administrative action, but it can also indicate an attempt to disable a compromised token or an adversary attempting to disrupt legitimate access.
This rule detects attempts to access Okta administrative functions when the request is routed through a proxy. This could indicate an adversary attempting to bypass security controls or obscure their origin when performing administrative actions within Okta.
Detects when an Okta ThreatInsight security threat is detected. This indicates that Okta has identified suspicious activity, potentially from a malicious IP address, attempting to access an organization's Okta tenant.
Detects the addition of a new VPN SSL Web Portal on a Fortinet FortiGate Firewall. This activity can be an indicator of an adversary establishing persistence or initial access, especially when observed in conjunction with other modifications to VPN SSL settings. Attackers might add new web portals to maintain access to the network or to create new entry points.
This rule detects changes to global permissions within Bitbucket. This includes requests to grant or remove global permissions, as well as the successful granting or removal of such permissions. Monitoring these events is crucial for identifying unauthorized privilege escalation or persistence attempts within a Bitbucket instance.
This rule detects when an organization owner disables Dependabot alerts for private repositories or Dependabot security updates for all repositories within GitHub. Dependabot performs scans to detect insecure dependencies and sends alerts, so disabling these features can increase an organization's exposure to vulnerabilities.
Page 178 of 680