Denial of Control `T0813`

ICS Tactic: Impact

Authoring guide

These 3 rules share fields, values, and exclusions.

Fields filtered most (6 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`DeletedUsers`	2	`gt` 2	`10`
`Attributes.old`	1	`is_not_null` 1
`DeletedUserName`	1	`is_not_null` 1
`EventOriginalType`	1	`in` 1	`CreateFlow`, `EditFlow`
`Message.object`	1	`contains` 1, `is_not_null` 1	, `DELETE`, `scim user`
`impactedUser`	1	`is_not_null` 1

Top indicator values (9 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`DeletedUsers`	`gt`	`10` kustoSAP BTP - Mass user deletion in a sub account kustoSAP BTP - Mass user deletion in Cloud Identity Service	2	2
`Attributes.old`	`is_not_null`	kustoSAP BTP - Mass user deletion in a sub account	1
`DeletedUserName`	`is_not_null`	kustoSAP BTP - Mass user deletion in a sub account	1
`EventOriginalType`	`in`	`CreateFlow` kustoPower Automate - Departing employee flow activity	1
`EventOriginalType`	`in`	`EditFlow` kustoPower Automate - Departing employee flow activity	1
`Message.object`	`contains`	`DELETE` kustoSAP BTP - Mass user deletion in a sub account	1
`Message.object`	`contains`	`scim user` kustoSAP BTP - Mass user deletion in a sub account	1
`Message.object`	`is_not_null`	kustoSAP BTP - Mass user deletion in a sub account	1	2
`impactedUser`	`is_not_null`	kustoSAP BTP - Mass user deletion in Cloud Identity Service	1

Rules under this technique

These vendors publish rules tagged with this technique.

Kusto 3 rules