Sagan medium stable other

[CROWDSTRIKE] Machine Learning Analysis Blocked - Mimikatz Quarantined Files In A Detection Summary Event

[CROWDSTRIKE] Machine Learning Analysis Blocked - Mimikatz Quarantined Files In A Detection Summary Event

View Source

Detection Logic

alert any any any -> any any (msg:"[CROWDSTRIKE] Machine Learning Analysis Blocked - Mimikatz Quarantined Files In A Detection Summary Event"; program:CrowdStrike; content:"Quarantined files in a detection summary event"; content:"Mimikatz"; content:"blocked"; content:!"msg="; nocase; content:"cat=Machine Learning"; parse_src_ip:1; normalize; classtype:suspicious-traffic; sid:5017780; rev: 2;)

Field Validations

Loading…

Comments (0)

Loading comments...