SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,493 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Indicates anomalous behavior based on suspicious sign-in activity across multiple tenants from different countries in the same browser
Indicates user activity that is unusual for the user or consistent with known attack patterns.
Identifies when an account hasn't signed in during the past n number of days.
Invalid PIM License
Sigma
Identifies when an organization doesn't have the proper license for PIM and is out of compliance.
Identifies when a privilege role assignment has taken place outside of PIM and may indicate an attack.
Identifies when the same privilege role has multiple activations by the same user.
Identifies when a privilege role can be activated without performing mfa.
Identifies when a user has been assigned a privilege role and are not using that role.
Monitor and alert for device registration or join events where MFA was not performed.
Detects risky authentication from a non AD registered device without MFA being required.
Page 88 of 680