Loss of Productivity and Revenue `T0828`

ICS Tactic: Impact

Authoring guide

These 2 rules share fields, values, and exclusions.

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`Anomalies`	1	`ne` 1	`0`
`CurrentAccountNum`	1	`cross_field_compare` 1	`OldAccountNum`
`DeletedFlowCount`	1	`ge` 1	`10`
`EventOriginalType`	1	`eq` 1	`deleteflow`
`LogType`	1	`eq` 1	`Update`
`TableName`	1	`eq` 1	`BankAccountTable`
`TimeGenerated`	1	`cross_field_compare` 1	`startTime`

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`Anomalies`	`ne`	`0` kustoPower Automate - Unusual bulk deletion of flow resources	1
`CurrentAccountNum`	`cross_field_compare`	`OldAccountNum` kustoF&O - Reverted bank account number modifications	1	2
`DeletedFlowCount`	`ge`	`10` kustoPower Automate - Unusual bulk deletion of flow resources	1
`EventOriginalType`	`eq`	`deleteflow` kustoPower Automate - Unusual bulk deletion of flow resources	1
`LogType`	`eq`	`Update` kustoF&O - Reverted bank account number modifications	1	3
`TableName`	`eq`	`BankAccountTable` kustoF&O - Reverted bank account number modifications	1	2
`TimeGenerated`	`cross_field_compare`	`startTime` kustoPower Automate - Unusual bulk deletion of flow resources	1

These vendors publish rules tagged with this technique.

Platform: Microsoft 365

Domain: SaaS