Sagan medium stable other

[CROWDSTRIKE] Possible Defense Evasion Attempt Blocked - Network Access In A Detection Summary Event

[CROWDSTRIKE] Possible Defense Evasion Attempt Blocked - Network Access In A Detection Summary Event

View Source

Detection Logic

alert any any any -> any any (msg:"[CROWDSTRIKE] Possible Defense Evasion Attempt Blocked - Network Access In A Detection Summary Event"; program:CrowdStrike; content:"Network Access In A Detection Summary Event"; content:!"msg="; content:"blocked"; nocase; content:"cat=Defense Evasion"; meta_content:!"fname=%sagan%.exe", chrome,msedge,firefox,explorer,opera,chromium,brave,iexplore,yandex,vivaldi; normalize; classtype:suspicious-traffic; sid:5017558; rev:1;)

Field Validations

Loading…

Comments (0)

Loading comments...