Sagan medium stable other

[MSAPI-EXCHANGE-BLUEDOT] MailboxLogin from Bluedot listed IP address

[MSAPI-EXCHANGE-BLUEDOT] MailboxLogin from Bluedot listed IP address

View Source

Detection Logic

alert any $HOME_NET any -> $EXTERNAL_NET any (msg: "[MSAPI-EXCHANGE-BLUEDOT] MailboxLogin from Bluedot listed IP address"; content:"ClientIP"; json_content: ".Workload","Exchange"; json_content: ".Operation", "MailboxLogin"; bluedot: type ip_reputation, track by_src, mdate_effective_period 3 months, Malicious,Tor,Honeypot,Proxy; json_map: "src_ip", ".ClientIP"; json_map: "dest_ip", ".ClientIP"; json_map: "username", ".UserId"; json_map: "program",".Workload"; classtype: suspicious-login; sid:5004876; rev: 2; metadata:updated_at 2023_08_01;)

Field Validations

Loading…

Comments (0)

Loading comments...