SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,508 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects delete actions within GitHub audit logs related to codespaces, environments, projects, and repositories. This can indicate an attempt to remove critical development infrastructure or source code.
Detects when the global SSH access configuration is changed within Bitbucket. This could indicate an attempt to enable or modify SSH access for malicious purposes, potentially for lateral movement or persistence.
This rule detects changes to self-hosted GitHub Actions runner configurations. These changes include actions such as removing a self-hosted runner from an organization or repository, creating or removing runner groups, and adding, removing, or updating runners within a runner group. Such modifications can indicate administrative actions related to CI/CD infrastructure, which should be validated for legitimacy.
Detects changes to the Bitbucket audit log configuration. This could indicate an adversary attempting to disable or modify logging to evade detection.
This rule detects when a repository within Bitbucket is configured to be exempt from secret scanning. This action could indicate an attempt to bypass security controls and hide sensitive information or malicious code within the repository without detection.
Detects when a user bypasses the push protection on a secret detected by secret scanning in GitHub. This indicates an attempt to commit code containing sensitive information despite automated safeguards.
Detects when a GitHub repository is archived or unarchived, which may indicate unauthorized changes to repository status. This action can be used by adversaries for various purposes, including defense evasion by hiding malicious repositories, persistence by making a repository less likely to be deleted, or impact by disrupting access to legitimate codebases.
Detects the addition of a new firewall policy on a Fortinet FortiGate Firewall. This activity could indicate an adversary attempting to alter network access controls for defense evasion, persistence, or to facilitate further malicious activity.
This rule detects hosts that are identified by a Qualys vulnerability scan as not having a firewall product detected. This indicates a compliance issue where a host is not protected by a firewall, potentially exposing it to unauthorized access or attacks. The alert signifies non-compliance with security policies.
This rule detects failed user login attempts within Bitbucket. It specifically looks for audit events categorized as 'Authentication' with the action 'User login failed'. This type of event can indicate various activities, including legitimate users mistyping passwords, or malicious actors attempting to brute-force credentials or perform credential stuffing attacks against Bitbucket accounts.
Page 179 of 680