SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,493 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Monitor and alert on conditional access changes.
Detects when an account was created and deleted in a short period of time.
Monitor and alert for Bitlocker key retrieval.
Monitor and alert for changes to the device registration policy.
Monitor and alert for users added to device admin roles.
Detects when a configuration change is made to an applications AppID URI.
Detects when a configuration change is made to an applications URI.
URIs for domain names that no longer exist (dangling URIs), not using HTTPS, wildcards at the end of the domain, URIs that are no unique to that app, or URIs that point to domains you do not control should be investigated.
URIs for domain names that no longer exist (dangling URIs), not using HTTPS, wildcards at the end of the domain, URIs that are no unique to that app, or URIs that point to domains you do not control should be investigated.
Change to authentication method could be an indicator of an attacker adding an auth method to the account so they can have continued access.
Detects when a user that doesn't have permissions to invite a guest user attempts to invite one.
Detects the change of user type from "Guest" to "Member" for potential elevation of privilege.
Page 86 of 680