Sagan high stable other

[MSEXCHANGE-MANAGEMENT] antispam-antimalware Cmdlet Remove-ContentFilterPhrase Successfully Executed

[MSEXCHANGE-MANAGEMENT] antispam-antimalware Cmdlet Remove-ContentFilterPhrase Successfully Executed

View Source

Detection Logic

alert any $HOME_NET any -> $HOME_NET any (msg:"[MSEXCHANGE-MANAGEMENT] antispam-antimalware Cmdlet Remove-ContentFilterPhrase Successfully Executed"; program:MSExchange_Management; event_id:1; content:"Cmdlet suceeded"; content:"Cmdlet Remove-ContentFilterPhrase"; reference:url,learn.microsoft.com/en-us/powershell/module/exchange/?view=exchange-ps; classtype:suspicious-command; sid:5012217; rev:1;)

Field Validations

Loading…

Comments (0)

Loading comments...