Sagan unknown stable other

[MSAPI-EXCHANGE] Data Loss Prevention Rule Match

[MSAPI-EXCHANGE] Data Loss Prevention Rule Match

View Source

Detection Logic

alert any $HOME_NET any -> $EXTERNAL_NET any (msg: "[MSAPI-EXCHANGE] Data Loss Prevention Rule Match"; json_content: ".Workload","Exchange"; json_content: ".Operation", "DlpRuleMatch"; content:!"phisher.knowbe4.com"; json_map: "username", ".UserId"; json_map: "program",".Workload"; classtype: misc-attack; sid:5004863; rev: 4; metadata: mitre_technique_id T1008, mitre_technique_id T1048, mitre_technique_id T1114;)

Field Validations

Loading…

Comments (0)

Loading comments...