SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,511 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects when events are deleted in Azure Kubernetes. An adversary may delete events in Azure Kubernetes in an attempt to evade detection by removing forensic evidence.
Identifies when a service principal is created in Azure. This activity can be an indicator of an adversary establishing persistence or preparing for further actions within the Azure environment.
This rule identifies when Kubernetes secrets are modified or deleted within a Google Cloud Platform (GCP) environment. It specifically looks for audit log entries related to the creation, update, patch, or deletion of Kubernetes secrets.
Detects when a firewall rule is modified, deleted, or inserted in Google Cloud Platform (GCP). This activity can indicate an adversary attempting to impair defenses or establish persistence by altering network access controls.
Detects when Microsoft Cloud App Security reports an activity originating from a country that has not been recently or ever visited by any user within the organization. This indicates potential unauthorized access or anomalous user behavior from an unusual geographic location.
Detects when Microsoft Cloud App Security identifies a user or IP address using an unsanctioned application to perform activities resembling data exfiltration from the organization. This rule specifically triggers on 'Data exfiltration to unsanctioned apps' events with a 'success' status from the SecurityComplianceCenter event source.
Detects changes to critical syslog daemon configuration files on Linux hosts. Adversaries may modify these files to disable or reconfigure logging, thereby impairing defenses and hindering the detection of their activities.
This rule detects the presence of base64 encoded shebangs (e.g., #!/bin/bash) within command-line arguments. Adversaries often encode commands to evade detection and obfuscate their malicious intent. The rule specifically looks for the base64 representations of common shell shebangs, indicating that a script or command containing these might be decoded and executed.
Detects the execution of the 'crontab -l' command, which is used to list scheduled cron jobs for the current user. This activity can be part of discovery tactics by adversaries to understand the system's scheduled tasks.
Detects file deletion using "rm", "shred" or "unlink" commands which are used often by adversaries to delete files left behind by the actions of their intrusion activity.
Page 462 of 680