Sagan high stable other

[MSEXCHANGE-MANAGEMENT] antispam-antimalware Cmdlet Get-AttachmentFilterEntry Successfully Executed

[MSEXCHANGE-MANAGEMENT] antispam-antimalware Cmdlet Get-AttachmentFilterEntry Successfully Executed

View Source

Detection Logic

alert any $HOME_NET any -> $HOME_NET any (msg:"[MSEXCHANGE-MANAGEMENT] antispam-antimalware Cmdlet Get-AttachmentFilterEntry Successfully Executed"; program:MSExchange_Management; event_id:1; content:"Cmdlet suceeded"; content:"Cmdlet Get-AttachmentFilterEntry"; reference:url,learn.microsoft.com/en-us/powershell/module/exchange/?view=exchange-ps; classtype:suspicious-command; sid:5012153; rev:1;)

Field Validations

Loading…

Comments (0)

Loading comments...