Detection Logic
alert any $HOME_NET any -> $HOME_NET any (msg:"[MICROSOFT-ATP] Exploit alert"; json_content: ".category", "Exploit"; json_contains; json_map: "flow_id", ".id"; json_map: "username", ".relatedUser.userName"; classtype: exploit-attempt; sid:5005694; rev:2;)Field Validations
Loading…
Comments (0)
Loading comments...