Sagan low stable other

Microsoft Exchange Active Monitoring device detected

Microsoft Exchange Active Monitoring device detected

View Source

Detection Logic

alert any $HOME_NET any -> $HOME_NET any (msg:"Microsoft Exchange Active Monitoring device detected"; program:Microsoft-Exchange-ActiveMonitoring*; metadata: fingerprint_source logs, fingerprint_os microsoft-windows, fingerprint_expire 86400; threshold: type suppress, track by_src, seconds 43200, count 1; classtype:fingerprint; sid:5013723; rev:1;)

Field Validations

Loading…

Comments (0)

Loading comments...