Sagan high stable other

[MSEXCHANGE-MANAGEMENT] policy-and-compliance-content-search Cmdlet Remove-ComplianceSecurityFilter Successfully Executed

[MSEXCHANGE-MANAGEMENT] policy-and-compliance-content-search Cmdlet Remove-ComplianceSecurityFilter Successfully Executed

View Source

Detection Logic

alert any $HOME_NET any -> $HOME_NET any (msg:"[MSEXCHANGE-MANAGEMENT] policy-and-compliance-content-search Cmdlet Remove-ComplianceSecurityFilter Successfully Executed"; program:MSExchange_Management; event_id:1; content:"Cmdlet suceeded"; content:"Cmdlet Remove-ComplianceSecurityFilter"; reference:url,learn.microsoft.com/en-us/powershell/module/exchange/?view=exchange-ps; classtype:suspicious-command; sid:5013059; rev:1;)

Field Validations

Loading…

Comments (0)

Loading comments...