Loss of Control `T0827`

ICS Tactic: Impact

Authoring guide

These 2 rules share fields, values, and exclusions.

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`DeletedUsers`	2	`gt` 2	`10`
`Attributes.old`	1	`is_not_null` 1
`DeletedUserName`	1	`is_not_null` 1
`Message.object`	1	`contains` 1, `is_not_null` 1	, `DELETE`, `scim user`
`impactedUser`	1	`is_not_null` 1

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`DeletedUsers`	`gt`	`10` kustoSAP BTP - Mass user deletion in a sub account kustoSAP BTP - Mass user deletion in Cloud Identity Service	2	2
`Attributes.old`	`is_not_null`	kustoSAP BTP - Mass user deletion in a sub account	1
`DeletedUserName`	`is_not_null`	kustoSAP BTP - Mass user deletion in a sub account	1
`Message.object`	`contains`	`DELETE` kustoSAP BTP - Mass user deletion in a sub account	1
`Message.object`	`contains`	`scim user` kustoSAP BTP - Mass user deletion in a sub account	1
`Message.object`	`is_not_null`	kustoSAP BTP - Mass user deletion in a sub account	1	2
`impactedUser`	`is_not_null`	kustoSAP BTP - Mass user deletion in Cloud Identity Service	1

These vendors publish rules tagged with this technique.

Platform: Application

Domain: Application