Sagan medium stable other

[CROWDSTRIKE] Machine Learning Analysis Blocked - PSExec Quarantined Files In An EPP Detection Summary Event

[CROWDSTRIKE] Machine Learning Analysis Blocked - PSExec Quarantined Files In An EPP Detection Summary Event

View Source

Detection Logic

alert any any any -> any any (msg:"[CROWDSTRIKE] Machine Learning Analysis Blocked - PSExec Quarantined Files In An EPP Detection Summary Event"; program:CrowdStrike; content:"Quarantined files in an EPP detection summary event"; content:"PSExec"; content:"blocked"; content:!"msg="; nocase; content:"cat=Machine Learning"; parse_src_ip:1; normalize; classtype:suspicious-traffic; sid:5017778; rev: 2;)

Field Validations

Loading…

Comments (0)

Loading comments...