SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,492 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects remote RPC calls to modify the registry and possible execute code
Detects the addition of a new network route to a route table in AWS.
Detects the import of SSH key pairs into AWS EC2, which may indicate an attacker attempting to gain unauthorized access to instances. This activity could lead to initial access, persistence, or privilege escalation, potentially compromising sensitive data and operations.
Detects a change in the AWS Identity Center (FKA AWS SSO) identity provider.
A change in identity provider allows an attacker to establish persistent access or escalate privileges via user impersonation.
A change in identity provider allows an attacker to establish persistent access or escalate privileges via user impersonation.
Identifies the suspicious use of GetSessionToken. Tokens could be created and used by attackers to move laterally and escalate privileges.
Identifies when an user or application modified the federation settings on the domain.
Monitor and alert on group membership removal of groups that have CA policy modification access
Detects when a PIM elevation is approved or denied. Outside of normal operations should be investigated.
Detects when a temporary access pass (TAP) is added to an account. TAPs added to priv accounts should be investigated
Detects successful authentication from potential clients using legacy authentication via user agent strings. This could be a sign of MFA bypass using a password spray attack.
Page 62 of 680