INDICATOR-COMPROMISE SettingContent-ms file type download attempt
This event is generated when a .SettingContent-ms file is downloaded on the Internet.
Attempted User Privilege Gain
Rule checks for attempts to download a .SettingContent-ms file.
Ease of attack
This rule will fire on all attempts to download .SettingContent-ms files.
- Cisco's Talos Intelligence Group