Sagan medium stable other

[MICROSOFT-ATP] Exfiltration alert

[MICROSOFT-ATP] Exfiltration alert

View Source

Detection Logic

alert any $HOME_NET any -> $HOME_NET any (msg:"[MICROSOFT-ATP] Exfiltration alert"; json_content: ".category", "Exfiltration"; json_contains; json_map: "flow_id", ".id"; json_map: "username", ".relatedUser.userName"; classtype: suspicious-traffic; sid:5005693; rev:2;)

Field Validations

Loading…

Comments (0)

Loading comments...