Sagan medium stable other

[Barracuda] IMPERSONATION Spear Phishing - Email Found to be Phishing

[Barracuda] IMPERSONATION Spear Phishing - Email Found to be Phishing

View Source

Detection Logic

alert any $EXTERNAL_NET any -> $HOME_NET any (msg:"[Barracuda] IMPERSONATION Spear Phishing - Email Found to be Phishing"; program:Sentinel; json_content: ".payload.category", "Spear Phishing Threat"; json_content: ".payload.type", "phishing"; json_content: !".payload.action_taken", "Message Deleted"; classtype: suspicious-traffic; reference:url,https://campus.barracuda.com/product/sentinel/doc/93192797/how-to-connect-to-a-syslog/; sid:5015580; rev:3; metadata: mitre_technique_id T1566.001 T1566.002;)

Field Validations

Loading…

Comments (0)

Loading comments...