Sagan medium stable other

[MSAPI-EXCHANGE-GEOIP] MailboxLogin from outside HOME_COUNTRY

[MSAPI-EXCHANGE-GEOIP] MailboxLogin from outside HOME_COUNTRY

View Source

Detection Logic

alert any $HOME_NET any -> $EXTERNAL_NET any (msg: "[MSAPI-EXCHANGE-GEOIP] MailboxLogin from outside HOME_COUNTRY"; content:"ClientIP"; json_content: ".Workload","Exchange"; json_content: ".Operation", "MailboxLogin"; country_code: track by_src, isnot $HOME_COUNTRY; json_map: "src_ip", ".ClientIP"; json_map: "dest_ip", ".ClientIP"; json_map: "username", ".UserId"; json_map: "program",".Workload"; classtype: suspicious-login; sid:5004866; rev: 3; metadata:updated_at 2023_08_01, mitre_tactic_id TA0006, mitre_technique_id T1078.004;)

Field Validations

Loading…

Comments (0)

Loading comments...