Sagan informational stable other

[CROWDSTRIKE] Initial Access Tactic - A user performed a network login from an unusual machine

[CROWDSTRIKE] Initial Access Tactic - A user performed a network login from an unusual machine

View Source

Detection Logic

alert any $HOME_NET any -> $HOME_NET any (msg:"[CROWDSTRIKE] Initial Access Tactic - A user performed a network login from an unusual machine"; program:CrowdStrike; content:"=Initial Access"; content:"msg=A user performed a network login from an unusual machine"; parse_src_ip:1; normalize; reference:url,https://www.reddit.com/r/crowdstrike/comments/rbbzwi/pattern_disposition_values_in_detect_api/; classtype:system-event; sid:5017323; rev:1; metadata:created_at 2025_12_02)

Field Validations

Loading…

Comments (0)

Loading comments...