SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,493 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects when PIM alerts are set to disabled.
Detects when changes are made to PIM roles
Detects when a user is added to a privileged role.
Detects when a new admin is created.
Detect when a user has reset their password in Azure AD
Identifies that users were active from an IP address that has been identified as an anonymous proxy IP address.
Atypical Travel
Sigma
Identifies two sign-ins originating from geographically distant locations, where at least one of the locations may also be atypical for the user, given past behavior.
Impossible Travel
Sigma
Identifies user activities originating from geographically distant locations within a time period shorter than the time it takes to travel from the first location to the second.
Detects suspicious rules that delete or move messages or folders are set on a user's inbox.
New Country
Sigma
Detects sign-ins from new countries. The detection considers past activity locations to determine new and infrequent locations.
Page 87 of 680