Sagan medium stable other

[MICROSOFT-ATP] CredentialAccess alert

[MICROSOFT-ATP] CredentialAccess alert

View Source

Detection Logic

alert any $HOME_NET any -> $HOME_NET any (msg:"[MICROSOFT-ATP] CredentialAccess alert"; json_content: ".category", "CredentialAccess"; json_contains; json_map: "flow_id", ".id"; json_map: "username", ".relatedUser.userName"; classtype: suspicious-traffic; sid:5005689; rev:2;)

Field Validations

Loading…

Comments (0)

Loading comments...