Sagan informational stable other

[CROWDSTRIKE] Quarantined Files In Endpoint Protection Platform

[CROWDSTRIKE] Quarantined Files In Endpoint Protection Platform

View Source

Detection Logic

alert any $HOME_NET any -> $HOME_NET any (msg:"[CROWDSTRIKE] Quarantined Files In Endpoint Protection Platform"; program:CrowdStrike; content: "Quarantined Files In An Epp Detection Summary Event"; content:!"technique=PUP"; threshold: type suppress, track by_src, count 5, seconds 5; normalize; classtype:system-event; sid:5017050; rev:1;)

Field Validations

Loading…

Comments (0)

Loading comments...