Sagan medium stable other

[CROWDSTRIKE] Possible Initial Access - First-time login to a machine by user

[CROWDSTRIKE] Possible Initial Access - First-time login to a machine by user

View Source

Detection Logic

alert any any any -> any any (msg:"[CROWDSTRIKE] Possible Initial Access - First-time login to a machine by user"; program:CrowdStrike; content:"A user logged in to a machine for the first time"; content:"tactic=Initial Access"; normalize; classtype:suspicious-traffic; sid:5017623; rev:1;)

Field Validations

Loading…

Comments (0)

Loading comments...