Loss of Control `T0827`

ICS Tactic: Impact

Authoring guide

These 2 rules share fields, values, and exclusions.

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`DeletedUsers`	2	`gt` 2	`10`
`DeletedUserName`	1	`is_not_null` 1
`action`	1	`eq` 1	`delete`
`group.name`	1	`contains` 1, `is_not_null` 1	`delete`, `scim user`
`impactedUser`	1	`is_not_null` 1
`objectType`	1	`eq` 1	`authorization`
`old`	1	`is_not_null` 1

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`DeletedUsers`	`gt`	`10` kustoSAP BTP - Mass user deletion in a sub account kustoSAP BTP - Mass user deletion in Cloud Identity Service	2	2
`action`	`eq`	`delete` kustoSAP BTP - Mass user deletion in Cloud Identity Service	1	2
`group.name`	`contains`	`delete` kustoSAP BTP - Mass user deletion in a sub account	1
`group.name`	`contains`	`scim user` kustoSAP BTP - Mass user deletion in a sub account	1
`objectType`	`eq`	`authorization` kustoSAP BTP - Mass user deletion in Cloud Identity Service	1

These vendors publish rules tagged with this technique.

Platform: Application

Domain: Application