SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,493 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Indicates sign-in from a malicious IP address known to be malicious at time of sign-in.
Indicates access attempt to the PRT resource which can be used to move laterally into an organization or perform credential theft
Detects when storage bucket is modified or deleted in Google Cloud.
Identifies when a VPN Tunnel Modified or Deleted in Google Cloud.
Detects when a Microsoft Cloud App Security reported when a user or IP address uses an app that is not sanctioned to perform an activity that resembles an attempt to exfiltrate information from your organization.
Alert on when a user has performed an eDiscovery search or exported a PST file from the search. This PST file usually has sensitive information including email body content
Detects shellshock expressions in log files
Detects suspicious command with /dev/tcp
Detects the use of grep to identify information about the operating system architecture. Often combined beforehand with the execution of "uname" or "cat /proc/cpuinfo"
Detects the creation of a new named pipe using the "mkfifo" utility
Page 596 of 680