SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,492 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects the recovery of a new public database instance from a snapshot. It may be a part of data exfiltration.
Identifies when a device or device configuration in azure is modified or deleted.
Identifies when DNS zone is modified or deleted.
Identifies when a Keyvault Key is modified or deleted in Azure.
Identifies when a Azure Kubernetes CronJob runs in Azure Cloud. Kubernetes Job is a controller that creates one or more pods and ensures that a specified number of them successfully terminate.
Kubernetes Job can be used to run containers that perform finite tasks for batch jobs. Kubernetes CronJob is used to schedule Jobs.
An Adversary may use Kubernetes CronJob for scheduling execution of malicious code that would run as a container in the cluster.
Kubernetes Job can be used to run containers that perform finite tasks for batch jobs. Kubernetes CronJob is used to schedule Jobs.
An Adversary may use Kubernetes CronJob for scheduling execution of malicious code that would run as a container in the cluster.
Identifies the deletion of Azure Kubernetes Pods.
Identifies when a Firewall Rule Configuration is Modified or Deleted.
Identifies when a virtual network device is being modified or deleted.
This can be a network interface, network virtual appliance, virtual hub, or virtual router.
This can be a network interface, network virtual appliance, virtual hub, or virtual router.
Identifies when a new cloudshell is created inside of Azure portal.
Identifies when a suppression rule is created in Azure. Adversary's could attempt this to evade detection.
Page 623 of 680