Sagan high stable other

[MSEXCHANGE-MANAGEMENT] defender-for-office-365 Cmdlet Get-ContentMalwareMdoDetailReport Successfully Executed

[MSEXCHANGE-MANAGEMENT] defender-for-office-365 Cmdlet Get-ContentMalwareMdoDetailReport Successfully Executed

View Source

Detection Logic

alert any $HOME_NET any -> $HOME_NET any (msg:"[MSEXCHANGE-MANAGEMENT] defender-for-office-365 Cmdlet Get-ContentMalwareMdoDetailReport Successfully Executed"; program:MSExchange_Management; event_id:1; content:"Cmdlet suceeded"; content:"Cmdlet Get-ContentMalwareMdoDetailReport"; reference:url,learn.microsoft.com/en-us/powershell/module/exchange/?view=exchange-ps; classtype:suspicious-command; sid:5012409; rev:1;)

Field Validations

Loading…

Comments (0)

Loading comments...