SigmaHQ Detections
@sigmaHQ12 followers122,467 downloads2,593 copies16 likes160,481 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects when events are deleted in Kubernetes.
An adversary may delete Kubernetes events in an attempt to evade detection.
An adversary may delete Kubernetes events in an attempt to evade detection.
Detects that network ACL entries have been added to a route table which could indicate that new attack vectors have been opened up in the AWS account.
AWS Root Credentials
Sigma
Detects AWS root account usage
Identifies when suspicious SAML activity has occurred in AWS. An adversary could gain backdoor access via SAML.
Detects when Events are deleted in Azure Kubernetes. An adversary may delete events in Azure Kubernetes in an attempt to evade detection.
Detects when certificate based authentication has been enabled in an Azure Active Directory tenant.
Detects newly added root certificate authority to an AzureAD tenant to support certificate based authentication.
Detects when a firewall rule is modified or deleted in Google Cloud Platform (GCP).
Detects when an Okta user session starts where the user is behind an anonymising proxy service.
Detects files with specially crafted filenames that embed Base64-encoded bash payloads designed to execute when processed by shell scripts.
These filenames exploit shell interpretation quirks to trigger hidden commands, a technique observed in VShell malware campaigns.
These filenames exploit shell interpretation quirks to trigger hidden commands, a technique observed in VShell malware campaigns.
Page 42 of 680