CrowdStrike Detects and Blocks Initial SharePoint Zero-Day Exploitation
correlate( cmd: { #event_simpleName=ProcessRollup2 event_platform=Win FileName=”cmd.exe” ParentBaseFileName=”w3wp.exe” } include: [aid, ComputerName, TargetProcessId, ParentBaseFileName, FileName, CommandLine], pwsh:…