ATP_Unwanted_Software
ID: 100258
Description:
An ATP event under the category “Unwanted Software” has been detected
Repository: Group: ATP Type: event
Default Status:
Enabled
| Tags: | |
|---|---|
| ATP | Defender |
Selector:
Query:
Filters:
| Field | MUST hit |
|---|---|
| @source | defenderATP |
| @defenderATP.Category | UnwantedSoftware |
| Field | MUST NOT hit |
|---|---|
Behavior Rule:
| Key | Type | Behavior Category |
|---|---|---|
| @defenderATP.MachineName | asset | security alert |
Risks:
| Risks | Base Score | Dimension |
|---|---|---|
Attributes:
| Alias | Key |
|---|---|
| DNS | @defenderATP.ComputerDnsName |
| MachineName | @defenderATP.MachineName |
| Description | @defenderATP.Description |
| Category | @defenderATP.Category |
| Severity | @defenderATP.Severity |
Correlation Rules:
First Occurrence:
| Name | Window | Fields |
|---|---|---|
| NewMachine | 10 days | @defenderATP.MachineName |
| Risks: | ML_NEW_ASSET |
History:
| User | Date |
|---|---|
| em*n@fluencysecurity.com | 2021 May 10 02:24:16 EDT |
| em*n@fluencysecurity.com | 2021 May 10 14:07:07 EDT |
This page was automatically created/formatted on Wed, 2022 May 4 21:43:53 EDT, from rule_dump.json (4d88bffdfb1cea26b3985f2193033606)