Sagan high stable other

[MSEXCHANGE-MANAGEMENT] policy-and-compliance-content-search Cmdlet Stop-ComplianceSearch Successfully Executed

[MSEXCHANGE-MANAGEMENT] policy-and-compliance-content-search Cmdlet Stop-ComplianceSearch Successfully Executed

View Source

Detection Logic

alert any $HOME_NET any -> $HOME_NET any (msg:"[MSEXCHANGE-MANAGEMENT] policy-and-compliance-content-search Cmdlet Stop-ComplianceSearch Successfully Executed"; program:MSExchange_Management; event_id:1; content:"Cmdlet suceeded"; content:"Cmdlet Stop-ComplianceSearch"; reference:url,learn.microsoft.com/en-us/powershell/module/exchange/?view=exchange-ps; classtype:suspicious-command; sid:5013067; rev:1;)

Field Validations

Loading…

Comments (0)

Loading comments...