SigmaHQ Detections
@sigmaHQ12 followers122,468 downloads2,593 copies16 likes160,482 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects successful AWS console logins that were performed without Multi-Factor Authentication (MFA).
This alert can be used to identify potential unauthorized access attempts, as logging in without MFA can indicate compromised credentials or misconfigured security settings.
This alert can be used to identify potential unauthorized access attempts, as logging in without MFA can indicate compromised credentials or misconfigured security settings.
Detects when an instance identity has taken an action that isn't inside SSM.
This can indicate that a compromised EC2 instance is being used as a pivot point.
This can indicate that a compromised EC2 instance is being used as a pivot point.
Detects the deletion of an AWS SAML provider, potentially indicating malicious intent to disrupt administrative or security team access.
An attacker can remove the SAML provider for the information security team or a team of system administrators, to make it difficult for them to work and investigate at the time of the attack and after it.
An attacker can remove the SAML provider for the information security team or a team of system administrators, to make it difficult for them to work and investigate at the time of the attack and after it.
Detects updates of the GuardDuty list of trusted IPs, perhaps to disable security alerts against malicious IPs.
Detects the modification of the findings on SecurityHub.
Monitor and alert on group membership additions of groups that have CA policy modification access
Detects sign-in with properties that are unfamiliar to the user. The detection considers past sign-in history to look for anomalous sign-ins.
Identifies an event where there are there are too many accounts assigned the Global Administrator role.
Detect failed attempts to sign in to disabled accounts.
Detects a login attempt in Google Workspace flagged as a potential attack by a government-backed threat actor
Page 49 of 680