Sagan medium stable other

[CROWDSTRIKE] Possible Command And Control Detected - Network Access In A Detection Summary Event

[CROWDSTRIKE] Possible Command And Control Detected - Network Access In A Detection Summary Event

View Source

Detection Logic

alert any any any -> any any (msg:"[CROWDSTRIKE] Possible Command And Control Detected - Network Access In A Detection Summary Event"; program:CrowdStrike; content:"Network Access In A Detection Summary Event"; content:!"msg="; content:"standard detection"; nocase; content:"tactic=Command and Control"; meta_content:!"fname=%sagan%.exe", chrome,msedge,firefox,explorer,opera,chromium,brave,iexplore,yandex,vivaldi; normalize; classtype:suspicious-traffic; sid:5017464; rev:1;)

Field Validations

Loading…

Comments (0)

Loading comments...