Sagan unknown stable other

[WINDOWS-SECURITY] SyncroSetup RMM Installed

[WINDOWS-SECURITY] SyncroSetup RMM Installed

View Source

Detection Logic

alert any $HOME_NET any -> $HOME_NET any (msg:"[WINDOWS-SECURITY] SyncroSetup RMM Installed"; program:*Security*; event_id:4688; content:"\SyncroSetup-"; parse_src_ip:1; normalize; classtype:command-and-control; sid:5015507; rev:1; metadata:created_at 2025_03_06, updated_at 2025_03_06, mitre_tactic_id TA0011, mitre_technique_id T1219;)

Field Validations

Loading…

Comments (0)

Loading comments...