Detection Logic
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[MCAS] Mass Download Attempt"; program: MCAS; json_content: ".Operation", "MCAS_ALERT_ANUBIS_DETECTION_REPEATED_ACTIVITY_DOWNLOAD"; json_contains; classtype: bad-unknown; sid: 5011309; rev: 2; metadata: mitre_technique_id T1002, mitre_technique_id T1048;)Field Validations
Loading…
Comments (0)
Loading comments...