Denial of Control `T0813`

ICS Tactic: Impact

Authoring guide

These 3 rules share fields, values, and exclusions.

Fields filtered most (8 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`DeletedUsers`	2	`gt` 2	`10`
`DeletedUserName`	1	`is_not_null` 1
`EventOriginalType`	1	`in` 1	`CreateFlow`, `EditFlow`
`action`	1	`eq` 1	`delete`
`group.name`	1	`contains` 1, `is_not_null` 1	`delete`, `scim user`
`impactedUser`	1	`is_not_null` 1
`objectType`	1	`eq` 1	`authorization`
`old`	1	`is_not_null` 1

Top indicator values (7 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`DeletedUsers`	`gt`	`10` kustoSAP BTP - Mass user deletion in a sub account kustoSAP BTP - Mass user deletion in Cloud Identity Service	2	2
`EventOriginalType`	`in`	`CreateFlow` kustoPower Automate - Departing employee flow activity	1
`EventOriginalType`	`in`	`EditFlow` kustoPower Automate - Departing employee flow activity	1
`action`	`eq`	`delete` kustoSAP BTP - Mass user deletion in Cloud Identity Service	1	2
`group.name`	`contains`	`delete` kustoSAP BTP - Mass user deletion in a sub account	1
`group.name`	`contains`	`scim user` kustoSAP BTP - Mass user deletion in a sub account	1
`objectType`	`eq`	`authorization` kustoSAP BTP - Mass user deletion in Cloud Identity Service	1

Rules under this technique

These vendors publish rules tagged with this technique.

Kusto 3 rules