SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,508 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects when a new identity provider is created in Okta. This activity can be a legitimate administrative action but could also indicate an attacker attempting to establish persistence or bypass authentication mechanisms by creating a rogue identity provider.
Detects the modification of VPN SSL Settings (for example, the modification of authentication rules).
This behavior was observed in pair with the addition of a VPN SSL Web Portal.
This behavior was observed in pair with the addition of a VPN SSL Web Portal.
Detects attempts to export user permission data from Bitbucket, which could indicate reconnaissance or data collection activities by an adversary.
Detects when a user in OneLogin assumes the identity of another user account. This could indicate an attacker using compromised credentials to impersonate another user or an insider abusing privileges.
This rule detects unauthorized access attempts to resources within Bitbucket. It specifically looks for audit events categorized under 'Security' with the action 'Unauthorized access to a resource'. This indicates that a user or system tried to access a Bitbucket resource without proper permissions.
Detects SSH user login access failures in Bitbucket. This rule can be noisy and is recommended to be used with correlation based on the "author.name" field to reduce false positives.
This rule detects attempts by an unauthorized user to trigger a full data export from Bitbucket. This activity could indicate an adversary attempting to collect sensitive information, such as source code or credentials, from the code repository.
This rule detects attempts to export user details from Bitbucket, including successful exports, failed attempts, and the initiation of such exports. This activity could indicate an adversary attempting to collect sensitive user information for further reconnaissance or data exfiltration.
This rule detects when a Multi-Factor Authentication (MFA) factor is deactivated or all MFA factors are reset for a user within Okta. This activity can indicate an adversary attempting to bypass or disable MFA to gain persistent access to an account.
Detects when an Okta Network Zone is deactivated or deleted. This activity can indicate an attempt to bypass network-based security controls, potentially allowing unauthorized access from untrusted IP ranges or locations. It could be a precursor to other malicious activities or an attempt to hinder forensic investigation.
Page 181 of 680