Sagan medium stable other
[CROWDSTRIKE] Machine Learning Analysis Blocked - PSExec Network Access In An EPP Detection Summary Event
[CROWDSTRIKE] Machine Learning Analysis Blocked - PSExec Network Access In An EPP Detection Summary Event
Detection Logic
alert any any any -> any any (msg:"[CROWDSTRIKE] Machine Learning Analysis Blocked - PSExec Network Access In An EPP Detection Summary Event"; program:CrowdStrike; content:"Network access in an EPP detection summary event"; content:"PSExec"; content:"standard detection"; content:!"msg="; nocase; content:"cat=Machine Learning"; parse_src_ip:1; parse_dst_ip:2; meta_content:!"fname=%sagan%.exe", chrome,msedge,firefox,explorer,opera,chromium,brave,iexplore,yandex,vivaldi; normalize; classtype:suspicious-traffic; sid:5017776; rev: 2;) Field Validations
Loading…
Comments (0)
Loading comments...