Loss of Availability `T0826`

ICS Tactic: Impact

Authoring guide

These 4 rules share fields, values, and exclusions.

Fields filtered most (10 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`DeletedUsers`	2	`gt` 2	`10`
`EventOriginalType`	2	`eq` 1, `in` 1	`CreateFlow`, `DeletePowerApp`, `EditFlow`
`AppCount`	1	`ge` 1	`25`
`DeletedUserName`	1	`is_not_null` 1
`EnvCount`	1	`ge` 1	`10`
`action`	1	`eq` 1	`delete`
`group.name`	1	`contains` 1, `is_not_null` 1	`delete`, `scim user`
`impactedUser`	1	`is_not_null` 1
`objectType`	1	`eq` 1	`authorization`
`old`	1	`is_not_null` 1

Top indicator values (10 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`DeletedUsers`	`gt`	`10` kustoSAP BTP - Mass user deletion in a sub account kustoSAP BTP - Mass user deletion in Cloud Identity Service	2	2
`AppCount`	`ge`	`25` kustoPower Apps - Multiple apps deleted	1
`EnvCount`	`ge`	`10` kustoPower Apps - Multiple apps deleted	1
`EventOriginalType`	`eq`	`DeletePowerApp` kustoPower Apps - Multiple apps deleted	1
`EventOriginalType`	`in`	`CreateFlow` kustoPower Automate - Departing employee flow activity	1
`EventOriginalType`	`in`	`EditFlow` kustoPower Automate - Departing employee flow activity	1
`action`	`eq`	`delete` kustoSAP BTP - Mass user deletion in Cloud Identity Service	1	2
`group.name`	`contains`	`delete` kustoSAP BTP - Mass user deletion in a sub account	1
`group.name`	`contains`	`scim user` kustoSAP BTP - Mass user deletion in a sub account	1
`objectType`	`eq`	`authorization` kustoSAP BTP - Mass user deletion in Cloud Identity Service	1

Rules under this technique

These vendors publish rules tagged with this technique.

Kusto 4 rules