Sagan unknown stable other

[MSAPI-THREATINTEL] Phishing attempt detected

[MSAPI-THREATINTEL] Phishing attempt detected

View Source

Detection Logic

alert any $HOME_NET any -> $EXTERNAL_NET any (msg: "[MSAPI-THREATINTEL] Phishing attempt detected"; json_content: ".Workload","ThreatIntelligence"; json_content:".Verdict","Phish"; json_content:!".DeliveryAction","Blocked"; json_meta_content:!".LatestDeliveryLocation",Failed,JunkFolder,Quarantine; json_meta_content:!".OriginalDeliveryLocation",JunkFolder,Quarantine; json_meta_content:!".SystemOverrides[0].Result",Allow; json_map: "src_ip", ".SenderIp"; json_map: "dest_ip", ".SenderIp"; json_map: "username", ".UserId"; json_map: "program",".Workload"; classtype: phish; sid:5004859; rev:5;)

Field Validations

Loading…

Comments (0)

Loading comments...