Sagan medium stable other

[MICROSOFT_DEFENDER_ENDPOINT] CommandAndControl High Alert Detected

[MICROSOFT_DEFENDER_ENDPOINT] CommandAndControl High Alert Detected

View Source

Detection Logic

alert any $HOME_NET any -> $HOME_NET any (msg:"[MICROSOFT_DEFENDER_ENDPOINT] CommandAndControl High Alert Detected"; program:microsoft-defender-endpoint-alerts_relayer; json_content:".status","New"; json_content:".category","CommandAndControl"; json_content:".severity","High"; json_map:"dest_ip",".evidence.ipAddress"; reference:url,https://github.com/MicrosoftDocs/defender-docs/blob/public/defender-endpoint/alerts-queue.md; classtype:suspicious-activity; sid:5015908; rev:1; metadata:created_at 2025_04_01, updated_at 2025_04_01;)

Field Validations

Loading…

Comments (0)

Loading comments...