SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,493 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects when a Microsoft Cloud App Security reported when a user signs into your sanctioned apps from a risky IP address.
Detects when a successful MFA authentication occurs due to the use of a bypass code.
A bypass code is a temporary passcode created by an administrator for a specific user to access a Duo-protected application. These are generally used as "backup codes," so that enrolled users who are having problems with their mobile devices (e.g., mobile service is disrupted, the device is lost or stolen, etc.) or who temporarily can't use their enrolled devices (on a plane without mobile data services) can still access their Duo-protected systems.
A bypass code is a temporary passcode created by an administrator for a specific user to access a Duo-protected application. These are generally used as "backup codes," so that enrolled users who are having problems with their mobile devices (e.g., mobile service is disrupted, the device is lost or stolen, etc.) or who temporarily can't use their enrolled devices (on a plane without mobile data services) can still access their Duo-protected systems.
Adversaries may use binary padding to add junk data and change the on-disk representation of malware.
This rule detect using dd and truncate to add a junk data to file.
This rule detect using dd and truncate to add a junk data to file.
Detects attempts to discover the files with setuid/setgid capability on them. That would allow adversary to escalate their privileges.
Detects removing immutable file attribute.
Masquerading occurs when the name or location of an executable, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation.
Several different variations of this technique have been observed.
Several different variations of this technique have been observed.
Detects embedding of files with usage of steghide binary, the adversaries may use this technique to prevent the detection of hidden information.
Detects extraction of files with usage of steghide binary, the adversaries may use this technique to prevent the detection of hidden information.
Detects extracting of zip file from image file
Identifies modification of ld.so.preload for shared object injection. This technique is used by attackers to load arbitrary code into processes.
Page 90 of 680