Sagan medium stable other
[CROWDSTRIKE] Possible Defense Evasion Attempt Detected - Network Access In A Detection Summary Event
[CROWDSTRIKE] Possible Defense Evasion Attempt Detected - Network Access In A Detection Summary Event
Detection Logic
alert any any any -> any any (msg:"[CROWDSTRIKE] Possible Defense Evasion Attempt Detected - Network Access In A Detection Summary Event"; program:CrowdStrike; content:"Network Access In A Detection Summary Event"; content:!"msg="; content:"standard detection"; nocase; content:"cat=Defense Evasion"; meta_content:!"fname=%sagan%.exe", chrome,msedge,firefox,explorer,opera,chromium,brave,iexplore,yandex,vivaldi; normalize; classtype:suspicious-traffic; sid:5017560; rev:1;) Field Validations
Loading…
Comments (0)
Loading comments...