Update PulseConnectSecureVPN-PasswordSpray.yaml
Renaming the detection query for better quality to indicate that the detection is based of PulseConnectSecure logs.
This commit is contained in:
Родитель
44257b18f4
Коммит
da7ad0bfdf
|
@ -1,5 +1,5 @@
|
|||
id: 1fa1528e-f746-4794-8a41-14827f4cb798
|
||||
name: Potential Password Spray Attempts
|
||||
name: PulseConnectSecure - Potential Password Spray Attempts
|
||||
description: |
|
||||
'This query identifies evidence of potential password spray activity against the Pulse Secure VPN server,
|
||||
by looking for failures from multiple accounts, originating from the same host within a time window'
|
||||
|
|
Загрузка…
Ссылка в новой задаче